<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[212365] trunk/Source</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/212365">212365</a></dd>
<dt>Author</dt> <dd>utatane.tea@gmail.com</dd>
<dt>Date</dt> <dd>2017-02-15 09:09:22 -0800 (Wed, 15 Feb 2017)</dd>
</dl>

<h3>Log Message</h3>
<pre>[JSC] Drop PassRefPtr
https://bugs.webkit.org/show_bug.cgi?id=168320

Reviewed by Saam Barati.

Source/JavaScriptCore:

* API/JSContextRef.cpp:
(JSGlobalContextCreateInGroup):
Use Ref&lt;VM&gt; from the factory function.

* API/JSScriptRef.cpp:
(OpaqueJSScript::create):
Return Ref&lt;&gt; instead.

* API/tests/JSONParseTest.cpp:
(testJSONParse):
Use Ref&lt;VM&gt;.

* assembler/LinkBuffer.cpp:
(JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
Use reference since we already perform null check.

* assembler/MacroAssemblerCodeRef.h:
(JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
Take Ref&lt;&gt;&amp;&amp; instead of PassRefPtr&lt;&gt;.

* bytecode/CallLinkInfo.h:
(JSC::CallLinkInfo::setStub):
(JSC::CallLinkInfo::setSlowStub):
Take Ref&lt;&gt;&amp;&amp; instead of PassRefPtr&lt;&gt;.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
Take RefPtr&lt;SourceProvider&gt;. Currently, the SourceProvider would be nullptr.
We will change it to Ref&lt;SourceProvider&gt; in https://bugs.webkit.org/show_bug.cgi?id=168325.

(JSC::CodeBlock::finishCreation):
Take Ref&lt;TypeSet&gt;&amp;&amp;.

* bytecode/CodeBlock.h:
(JSC::CodeBlock::setJITCode):
Take Ref&lt;&gt;&amp;&amp; instead.

(JSC::CodeBlock::jitCode):
Return RefPtr&lt;&gt; instead.

* bytecode/EvalCodeBlock.h:
(JSC::EvalCodeBlock::create):
Take RefPtr&lt;&gt;&amp;&amp; instead since SourceProvider woule be nullptr.

(JSC::EvalCodeBlock::EvalCodeBlock):
* bytecode/FunctionCodeBlock.h:
(JSC::FunctionCodeBlock::create):
(JSC::FunctionCodeBlock::FunctionCodeBlock):
Take RefPtr&lt;&gt;&amp;&amp; instead since SourceProvider woule be nullptr.

* bytecode/GlobalCodeBlock.h:
(JSC::GlobalCodeBlock::GlobalCodeBlock):
Take RefPtr&lt;&gt;&amp;&amp; instead since SourceProvider woule be nullptr.

* bytecode/ModuleProgramCodeBlock.h:
(JSC::ModuleProgramCodeBlock::create):
(JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock):
Take RefPtr&lt;&gt;&amp;&amp; instead since SourceProvider woule be nullptr.

* bytecode/ProgramCodeBlock.h:
(JSC::ProgramCodeBlock::create):
(JSC::ProgramCodeBlock::ProgramCodeBlock):
Take RefPtr&lt;&gt;&amp;&amp; instead since SourceProvider woule be nullptr.

* debugger/DebuggerParseData.cpp:
(JSC::gatherDebuggerParseDataForSource):
Ensure the provider is not nullptr. It is OK because we already
touch `provider-&gt;xxx` values.

* dfg/DFGBlockInsertionSet.cpp:
(JSC::DFG::BlockInsertionSet::insert):
Take Ref&lt;&gt;&amp;&amp; instead.

* dfg/DFGBlockInsertionSet.h:
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::inlineCall):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::parseCodeBlock):
Pass Ref&lt;&gt;&amp;&amp; to appendBlock.

* dfg/DFGDriver.cpp:
(JSC::DFG::compileImpl):
(JSC::DFG::compile):
Pass Ref&lt;Plan&gt;&amp;&amp;. And take Ref&lt;&gt;&amp;&amp; callback.

* dfg/DFGDriver.h:
* dfg/DFGGraph.h:
appendBlock takes Ref&lt;&gt;&amp;&amp;.

(JSC::DFG::Graph::appendBlock):
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):
* dfg/DFGJITCompiler.h:
(JSC::DFG::JITCompiler::jitCode):
* dfg/DFGJITFinalizer.cpp:
(JSC::DFG::JITFinalizer::JITFinalizer):
Take Ref&lt;JITCode&gt;&amp;&amp;.

(JSC::DFG::JITFinalizer::finalize):
(JSC::DFG::JITFinalizer::finalizeFunction):
(JSC::DFG::JITFinalizer::finalizeCommon):
Pass compilation reference since we already perform null check.

* dfg/DFGJITFinalizer.h:
* dfg/DFGWorklist.cpp:
(JSC::DFG::Worklist::enqueue):
Take Ref&lt;Plan&gt;&amp;&amp;.

* dfg/DFGWorklist.h:
* ftl/FTLJITFinalizer.cpp:
(JSC::FTL::JITFinalizer::finalizeFunction):
Dereference and pass jitCode &amp; compilation references.

* jit/GCAwareJITStubRoutine.cpp:
(JSC::createJITStubRoutine):
Return Ref&lt;&gt; instead.

* jit/GCAwareJITStubRoutine.h:
(JSC::createJITStubRoutine):
* jit/JIT.cpp:
(JSC::JIT::link):
Pass compilation reference since we already perform null check.

* jit/JITStubRoutine.h:
(JSC::JITStubRoutine::asCodePtr):
Take Ref&lt;&gt;&amp;&amp; instead. And this drops unnecessary null check.

* jit/JITThunks.cpp:
(JSC::JITThunks::hostFunctionStub):
Pass Ref&lt;&gt; to NativeExecutable::create.

* llint/LLIntEntrypoint.cpp:
(JSC::LLInt::setFunctionEntrypoint):
(JSC::LLInt::setEvalEntrypoint):
(JSC::LLInt::setProgramEntrypoint):
(JSC::LLInt::setModuleProgramEntrypoint):
Use Ref&lt;&gt;&amp;&amp; instead.

* parser/SourceCode.h:
(JSC::SourceCode::SourceCode):
(JSC::SourceCode::subExpression):
Add constructors taking Ref&lt;&gt;&amp;&amp;.
We still have constructors that take RefPtr&lt;&gt;&amp;&amp;.
We will change it to Ref&lt;SourceProvider&gt;&amp;&amp; in https://bugs.webkit.org/show_bug.cgi?id=168325.

* parser/UnlinkedSourceCode.h:
(JSC::UnlinkedSourceCode::UnlinkedSourceCode):
Add constructors taking Ref&lt;&gt;&amp;&amp;.
We still have constructors that take RefPtr&lt;&gt;&amp;&amp;.
We will change it to Ref&lt;SourceProvider&gt;&amp;&amp; in https://bugs.webkit.org/show_bug.cgi?id=168325.

* profiler/ProfilerDatabase.cpp:
(JSC::Profiler::Database::addCompilation):
Take Ref&lt;Compilation&gt;&amp;&amp;.

* profiler/ProfilerDatabase.h:
Change data structures to hold Ref&lt;&gt; instead of RefPtr&lt;&gt;.

* runtime/EvalExecutable.h:
(JSC::EvalExecutable::generatedJITCode):
Return Ref&lt;&gt; instead.

* runtime/ExecutableBase.h:
(JSC::ExecutableBase::generatedJITCodeForCall):
(JSC::ExecutableBase::generatedJITCodeForConstruct):
(JSC::ExecutableBase::generatedJITCodeFor):
Return Ref&lt;&gt; instead.

* runtime/Identifier.cpp:
(JSC::Identifier::add):
(JSC::Identifier::add8):
* runtime/Identifier.h:
(JSC::Identifier::add):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::setInputCursor):
And take Ref&lt;&gt; in this method.

* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::inputCursor):
Change m_inputCursor from RefPtr&lt;&gt; to Ref&lt;&gt;.

* runtime/JSPropertyNameEnumerator.cpp:
(JSC::JSPropertyNameEnumerator::create):
(JSC::JSPropertyNameEnumerator::finishCreation):
Take Ref&lt;PropertyNameArray&gt;&amp;&amp;.

* runtime/JSPropertyNameEnumerator.h:
(JSC::propertyNameEnumerator):
* runtime/JSString.h:
(JSC::JSString::JSString):
Take Ref&lt;StringImpl&gt;&amp;&amp; since we do not allow nullptr in this constructor.

(JSC::JSString::create):
(JSC::JSString::createHasOtherOwner):
Take Ref&lt;StringImpl&gt;&amp;&amp; in these factory functions. And drop unnecessary assertions.

(JSC::jsSingleCharacterString):
Use StringImpl::create() which returns Ref&lt;&gt;.

(JSC::jsNontrivialString):
Dereference impl() since we ensure that `s.length() &gt; 1`.

(JSC::jsString):
Use releaseNonNull() since we ensure that `s.length() &gt; 1`.

(JSC::jsOwnedString):
Use releaseNonNull() since we ensure that `s.length() &gt; 1`.

* runtime/ModuleProgramExecutable.h:
* runtime/NativeExecutable.cpp:
(JSC::NativeExecutable::create):
(JSC::NativeExecutable::finishCreation):
Take Ref&lt;JITCode&gt;&amp;&amp;.

* runtime/NativeExecutable.h:
* runtime/ProgramExecutable.h:
Return Ref&lt;JITCode&gt;.

* runtime/PropertyNameArray.h:
(JSC::PropertyNameArray::releaseData):
(JSC::PropertyNameArray::setData): Deleted.
This is not used.

* runtime/RegExpKey.h:
(JSC::RegExpKey::RegExpKey):
Take RefPtr&lt;&gt;&amp;&amp;.

* runtime/SmallStrings.cpp:
(JSC::SmallStringsStorage::rep):
Return StringImpl&amp; since m_reps is already initialized in the constructor.

(JSC::SmallStrings::createEmptyString):
Dereference StringImpl::empty().

(JSC::SmallStrings::createSingleCharacterString):
Use StringImpl&amp;.

(JSC::SmallStrings::singleCharacterStringRep):
Return StringImpl&amp;.

(JSC::SmallStrings::initialize):
Use AtomicStringImpl::add instead.

* runtime/SmallStrings.h:
* runtime/Structure.cpp:
(JSC::Structure::toStructureShape):
Return Ref&lt;&gt;.

* runtime/Structure.h:
* runtime/TypeLocationCache.cpp:
(JSC::TypeLocationCache::getTypeLocation):
Take RefPtr&lt;TypeSet&gt;&amp;&amp;.

* runtime/TypeLocationCache.h:
* runtime/TypeProfilerLog.cpp:
Pass Ref&lt;&gt;&amp;&amp;.

(JSC::TypeProfilerLog::processLogEntries):
* runtime/TypeSet.cpp:
(JSC::TypeSet::addTypeInformation):
Take RefPtr&lt;&gt;&amp;&amp; since it can be nullptr.
And clean up &quot;not found&quot; code.

(JSC::TypeSet::allStructureRepresentations):
Use range based iteration.

(JSC::StructureShape::leastCommonAncestor):
We found that this method accidentally takes `const Vector&lt;&gt;` instead of `const Vector&lt;&gt;&amp;`.
And internally, we just use raw pointers since these StructureShapes are owned by the m_proto trees which starts from the given Vector&lt;&gt;.

(JSC::StructureShape::hasSamePrototypeChain):
Take const reference instead. And use raw pointers internally.

(JSC::StructureShape::merge):
Take Ref&lt;&gt;&amp;&amp;.

* runtime/TypeSet.h:
(JSC::StructureShape::setProto):
Take Ref&lt;&gt;&amp;&amp;.

* runtime/VM.cpp:
(JSC::VM::getHostFunction):
Pass Ref&lt;&gt;&amp;&amp;.

(JSC::VM::queueMicrotask):
Take and pass Ref&lt;&gt;&amp;&amp;.

* runtime/VM.h:
(JSC::QueuedTask::QueuedTask):
Take Ref&lt;&gt;&amp;&amp;.

* tools/FunctionOverrides.cpp:
(JSC::initializeOverrideInfo):
We need this change due to Ref&lt;&gt;&amp;&amp; and RefPtr&lt;&gt;&amp;&amp; ambiguity of SourceCode constructors.
Once SourceCode is fixed to only take Ref&lt;&gt;&amp;&amp;, this change is unnecessary.

Source/WebCore:

* bindings/js/ScriptSourceCode.h:
(WebCore::ScriptSourceCode::ScriptSourceCode):
Use Ref and pass it to SourceCode.

* replay/ReplayController.cpp:
(WebCore::ReplayController::frameNavigated):
Pass reference.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreAPIJSContextRefcpp">trunk/Source/JavaScriptCore/API/JSContextRef.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreAPIJSScriptRefcpp">trunk/Source/JavaScriptCore/API/JSScriptRef.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreAPItestsJSONParseTestcpp">trunk/Source/JavaScriptCore/API/tests/JSONParseTest.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreassemblerLinkBuffercpp">trunk/Source/JavaScriptCore/assembler/LinkBuffer.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreassemblerMacroAssemblerCodeRefh">trunk/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCallLinkInfoh">trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockh">trunk/Source/JavaScriptCore/bytecode/CodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeEvalCodeBlockh">trunk/Source/JavaScriptCore/bytecode/EvalCodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeFunctionCodeBlockh">trunk/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGlobalCodeBlockh">trunk/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeModuleProgramCodeBlockh">trunk/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeProgramCodeBlockh">trunk/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerParseDatacpp">trunk/Source/JavaScriptCore/debugger/DebuggerParseData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBlockInsertionSetcpp">trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBlockInsertionSeth">trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDrivercpp">trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDriverh">trunk/Source/JavaScriptCore/dfg/DFGDriver.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGJITCompilercpp">trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGJITFinalizercpp">trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGJITFinalizerh">trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWorklistcpp">trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWorklisth">trunk/Source/JavaScriptCore/dfg/DFGWorklist.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLJITFinalizercpp">trunk/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitGCAwareJITStubRoutinecpp">trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitGCAwareJITStubRoutineh">trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITcpp">trunk/Source/JavaScriptCore/jit/JIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITStubRoutineh">trunk/Source/JavaScriptCore/jit/JITStubRoutine.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITThunkscpp">trunk/Source/JavaScriptCore/jit/JITThunks.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntEntrypointcpp">trunk/Source/JavaScriptCore/llint/LLIntEntrypoint.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserSourceCodeh">trunk/Source/JavaScriptCore/parser/SourceCode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserUnlinkedSourceCodeh">trunk/Source/JavaScriptCore/parser/UnlinkedSourceCode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreprofilerProfilerDatabasecpp">trunk/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreprofilerProfilerDatabaseh">trunk/Source/JavaScriptCore/profiler/ProfilerDatabase.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeEvalExecutableh">trunk/Source/JavaScriptCore/runtime/EvalExecutable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeExecutableBaseh">trunk/Source/JavaScriptCore/runtime/ExecutableBase.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIdentifiercpp">trunk/Source/JavaScriptCore/runtime/Identifier.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIdentifierh">trunk/Source/JavaScriptCore/runtime/Identifier.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjecth">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPropertyNameEnumeratorcpp">trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPropertyNameEnumeratorh">trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSStringh">trunk/Source/JavaScriptCore/runtime/JSString.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeModuleProgramExecutableh">trunk/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNativeExecutablecpp">trunk/Source/JavaScriptCore/runtime/NativeExecutable.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNativeExecutableh">trunk/Source/JavaScriptCore/runtime/NativeExecutable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeProgramExecutableh">trunk/Source/JavaScriptCore/runtime/ProgramExecutable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePropertyNameArrayh">trunk/Source/JavaScriptCore/runtime/PropertyNameArray.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpKeyh">trunk/Source/JavaScriptCore/runtime/RegExpKey.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSmallStringscpp">trunk/Source/JavaScriptCore/runtime/SmallStrings.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSmallStringsh">trunk/Source/JavaScriptCore/runtime/SmallStrings.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructurecpp">trunk/Source/JavaScriptCore/runtime/Structure.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureh">trunk/Source/JavaScriptCore/runtime/Structure.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypeLocationCachecpp">trunk/Source/JavaScriptCore/runtime/TypeLocationCache.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypeLocationCacheh">trunk/Source/JavaScriptCore/runtime/TypeLocationCache.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypeProfilerLogcpp">trunk/Source/JavaScriptCore/runtime/TypeProfilerLog.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypeSetcpp">trunk/Source/JavaScriptCore/runtime/TypeSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypeSeth">trunk/Source/JavaScriptCore/runtime/TypeSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretoolsFunctionOverridescpp">trunk/Source/JavaScriptCore/tools/FunctionOverrides.cpp</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsScriptSourceCodeh">trunk/Source/WebCore/bindings/js/ScriptSourceCode.h</a></li>
<li><a href="#trunkSourceWebCorereplayReplayControllercpp">trunk/Source/WebCore/replay/ReplayController.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreAPIJSContextRefcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSContextRef.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/JSContextRef.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/API/JSContextRef.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -133,12 +133,12 @@
</span><span class="cx"> {
</span><span class="cx">     initializeThreading();
</span><span class="cx"> 
</span><del>-    RefPtr&lt;VM&gt; vm = group ? PassRefPtr&lt;VM&gt;(toJS(group)) : VM::createContextGroup();
</del><ins>+    Ref&lt;VM&gt; vm = group ? Ref&lt;VM&gt;(*toJS(group)) : VM::createContextGroup();
</ins><span class="cx"> 
</span><del>-    JSLockHolder locker(vm.get());
</del><ins>+    JSLockHolder locker(vm.ptr());
</ins><span class="cx"> 
</span><span class="cx">     if (!globalObjectClass) {
</span><del>-        JSGlobalObject* globalObject = JSGlobalObject::create(*vm, JSGlobalObject::createStructure(*vm, jsNull()));
</del><ins>+        JSGlobalObject* globalObject = JSGlobalObject::create(vm.get(), JSGlobalObject::createStructure(vm.get(), jsNull()));
</ins><span class="cx"> #if ENABLE(REMOTE_INSPECTOR)
</span><span class="cx">         if (JSRemoteInspectorGetInspectionEnabledByDefault())
</span><span class="cx">             globalObject-&gt;setRemoteDebuggingEnabled(true);
</span><span class="lines">@@ -146,12 +146,12 @@
</span><span class="cx">         return JSGlobalContextRetain(toGlobalRef(globalObject-&gt;globalExec()));
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    JSGlobalObject* globalObject = JSCallbackObject&lt;JSGlobalObject&gt;::create(*vm, globalObjectClass, JSCallbackObject&lt;JSGlobalObject&gt;::createStructure(*vm, 0, jsNull()));
</del><ins>+    JSGlobalObject* globalObject = JSCallbackObject&lt;JSGlobalObject&gt;::create(vm.get(), globalObjectClass, JSCallbackObject&lt;JSGlobalObject&gt;::createStructure(vm.get(), 0, jsNull()));
</ins><span class="cx">     ExecState* exec = globalObject-&gt;globalExec();
</span><span class="cx">     JSValue prototype = globalObjectClass-&gt;prototype(exec);
</span><span class="cx">     if (!prototype)
</span><span class="cx">         prototype = jsNull();
</span><del>-    globalObject-&gt;resetPrototype(*vm, prototype);
</del><ins>+    globalObject-&gt;resetPrototype(vm.get(), prototype);
</ins><span class="cx"> #if ENABLE(REMOTE_INSPECTOR)
</span><span class="cx">     if (JSRemoteInspectorGetInspectionEnabledByDefault())
</span><span class="cx">         globalObject-&gt;setRemoteDebuggingEnabled(true);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreAPIJSScriptRefcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSScriptRef.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/JSScriptRef.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/API/JSScriptRef.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx"> 
</span><span class="cx"> struct OpaqueJSScript : public SourceProvider {
</span><span class="cx"> public:
</span><del>-    static WTF::RefPtr&lt;OpaqueJSScript&gt; create(VM&amp; vm, const SourceOrigin&amp; sourceOrigin, const String&amp; url, int startingLineNumber, const String&amp; source)
</del><ins>+    static WTF::Ref&lt;OpaqueJSScript&gt; create(VM&amp; vm, const SourceOrigin&amp; sourceOrigin, const String&amp; url, int startingLineNumber, const String&amp; source)
</ins><span class="cx">     {
</span><span class="cx">         return WTF::adoptRef(*new OpaqueJSScript(vm, sourceOrigin, url, startingLineNumber, source));
</span><span class="cx">     }
</span><span class="lines">@@ -97,7 +97,7 @@
</span><span class="cx">     auto result = OpaqueJSScript::create(vm, SourceOrigin { sourceURLString }, sourceURLString, startingLineNumber, String(StringImpl::createFromLiteral(source, length)));
</span><span class="cx"> 
</span><span class="cx">     ParserError error;
</span><del>-    if (!parseScript(vm, SourceCode(result), error)) {
</del><ins>+    if (!parseScript(vm, SourceCode(result.copyRef()), error)) {
</ins><span class="cx">         if (errorMessage)
</span><span class="cx">             *errorMessage = OpaqueJSString::create(error.message()).leakRef();
</span><span class="cx">         if (errorLine)
</span><span class="lines">@@ -105,7 +105,7 @@
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return result.leakRef();
</del><ins>+    return &amp;result.leakRef();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSScriptRef JSScriptCreateFromString(JSContextGroupRef contextGroup, JSStringRef url, int startingLineNumber, JSStringRef source, JSStringRef* errorMessage, int* errorLine)
</span><span class="lines">@@ -119,7 +119,7 @@
</span><span class="cx">     auto result = OpaqueJSScript::create(vm, SourceOrigin { sourceURLString }, sourceURLString, startingLineNumber, source-&gt;string());
</span><span class="cx"> 
</span><span class="cx">     ParserError error;
</span><del>-    if (!parseScript(vm, SourceCode(result), error)) {
</del><ins>+    if (!parseScript(vm, SourceCode(result.copyRef()), error)) {
</ins><span class="cx">         if (errorMessage)
</span><span class="cx">             *errorMessage = OpaqueJSString::create(error.message()).leakRef();
</span><span class="cx">         if (errorLine)
</span><span class="lines">@@ -127,7 +127,7 @@
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return result.leakRef();
</del><ins>+    return &amp;result.leakRef();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JSScriptRetain(JSScriptRef script)
</span><span class="lines">@@ -152,7 +152,7 @@
</span><span class="cx">     }
</span><span class="cx">     NakedPtr&lt;Exception&gt; internalException;
</span><span class="cx">     JSValue thisValue = thisValueRef ? toJS(exec, thisValueRef) : jsUndefined();
</span><del>-    JSValue result = evaluate(exec, SourceCode(script), thisValue, internalException);
</del><ins>+    JSValue result = evaluate(exec, SourceCode(*script), thisValue, internalException);
</ins><span class="cx">     if (internalException) {
</span><span class="cx">         if (exception)
</span><span class="cx">             *exception = toRef(exec, internalException-&gt;value());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreAPItestsJSONParseTestcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/tests/JSONParseTest.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/tests/JSONParseTest.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/API/tests/JSONParseTest.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -38,28 +38,28 @@
</span><span class="cx"> {
</span><span class="cx">     bool failed = false;
</span><span class="cx"> 
</span><del>-    RefPtr&lt;VM&gt; vm = VM::create();
</del><ins>+    {
+        Ref&lt;VM&gt; vm = VM::create();
</ins><span class="cx"> 
</span><del>-    JSLockHolder locker(vm.get());
-    JSGlobalObject* globalObject = JSGlobalObject::create(*vm, JSGlobalObject::createStructure(*vm, jsNull()));
</del><ins>+        JSLockHolder locker(vm.ptr());
+        JSGlobalObject* globalObject = JSGlobalObject::create(vm.get(), JSGlobalObject::createStructure(vm.get(), jsNull()));
</ins><span class="cx"> 
</span><del>-    ExecState* exec = globalObject-&gt;globalExec();
-    JSValue v0 = JSONParse(exec, &quot;&quot;);
-    JSValue v1 = JSONParse(exec, &quot;#$%^&quot;);
-    JSValue v2 = JSONParse(exec, String());
-    UChar emptyUCharArray[1] = { '\0' };
-    JSValue v3 = JSONParse(exec, String(emptyUCharArray, 0));
-    JSValue v4;
-    JSValue v5 = JSONParse(exec, &quot;123&quot;);
</del><ins>+        ExecState* exec = globalObject-&gt;globalExec();
+        JSValue v0 = JSONParse(exec, &quot;&quot;);
+        JSValue v1 = JSONParse(exec, &quot;#$%^&quot;);
+        JSValue v2 = JSONParse(exec, String());
+        UChar emptyUCharArray[1] = { '\0' };
+        JSValue v3 = JSONParse(exec, String(emptyUCharArray, 0));
+        JSValue v4;
+        JSValue v5 = JSONParse(exec, &quot;123&quot;);
</ins><span class="cx"> 
</span><del>-    failed = failed || (v0 != v1);
-    failed = failed || (v1 != v2);
-    failed = failed || (v2 != v3);
-    failed = failed || (v3 != v4);
-    failed = failed || (v4 == v5);
</del><ins>+        failed = failed || (v0 != v1);
+        failed = failed || (v1 != v2);
+        failed = failed || (v2 != v3);
+        failed = failed || (v3 != v4);
+        failed = failed || (v4 == v5);
+    }
</ins><span class="cx"> 
</span><del>-    vm = nullptr;
-
</del><span class="cx">     if (failed)
</span><span class="cx">         printf(&quot;FAIL: JSONParse String test.\n&quot;);
</span><span class="cx">     else
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/ChangeLog        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -1,3 +1,307 @@
</span><ins>+2017-02-15  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
+
+        [JSC] Drop PassRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=168320
+
+        Reviewed by Saam Barati.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreateInGroup):
+        Use Ref&lt;VM&gt; from the factory function.
+
+        * API/JSScriptRef.cpp:
+        (OpaqueJSScript::create):
+        Return Ref&lt;&gt; instead.
+
+        * API/tests/JSONParseTest.cpp:
+        (testJSONParse):
+        Use Ref&lt;VM&gt;.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
+        Use reference since we already perform null check.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
+        Take Ref&lt;&gt;&amp;&amp; instead of PassRefPtr&lt;&gt;.
+
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::setStub):
+        (JSC::CallLinkInfo::setSlowStub):
+        Take Ref&lt;&gt;&amp;&amp; instead of PassRefPtr&lt;&gt;.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        Take RefPtr&lt;SourceProvider&gt;. Currently, the SourceProvider would be nullptr.
+        We will change it to Ref&lt;SourceProvider&gt; in https://bugs.webkit.org/show_bug.cgi?id=168325.
+
+        (JSC::CodeBlock::finishCreation):
+        Take Ref&lt;TypeSet&gt;&amp;&amp;.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        Take Ref&lt;&gt;&amp;&amp; instead.
+
+        (JSC::CodeBlock::jitCode):
+        Return RefPtr&lt;&gt; instead.
+
+        * bytecode/EvalCodeBlock.h:
+        (JSC::EvalCodeBlock::create):
+        Take RefPtr&lt;&gt;&amp;&amp; instead since SourceProvider woule be nullptr.
+
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        * bytecode/FunctionCodeBlock.h:
+        (JSC::FunctionCodeBlock::create):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        Take RefPtr&lt;&gt;&amp;&amp; instead since SourceProvider woule be nullptr.
+
+        * bytecode/GlobalCodeBlock.h:
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        Take RefPtr&lt;&gt;&amp;&amp; instead since SourceProvider woule be nullptr.
+
+        * bytecode/ModuleProgramCodeBlock.h:
+        (JSC::ModuleProgramCodeBlock::create):
+        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock):
+        Take RefPtr&lt;&gt;&amp;&amp; instead since SourceProvider woule be nullptr.
+
+        * bytecode/ProgramCodeBlock.h:
+        (JSC::ProgramCodeBlock::create):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        Take RefPtr&lt;&gt;&amp;&amp; instead since SourceProvider woule be nullptr.
+
+        * debugger/DebuggerParseData.cpp:
+        (JSC::gatherDebuggerParseDataForSource):
+        Ensure the provider is not nullptr. It is OK because we already
+        touch `provider-&gt;xxx` values.
+
+        * dfg/DFGBlockInsertionSet.cpp:
+        (JSC::DFG::BlockInsertionSet::insert):
+        Take Ref&lt;&gt;&amp;&amp; instead.
+
+        * dfg/DFGBlockInsertionSet.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        Pass Ref&lt;&gt;&amp;&amp; to appendBlock.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        (JSC::DFG::compile):
+        Pass Ref&lt;Plan&gt;&amp;&amp;. And take Ref&lt;&gt;&amp;&amp; callback.
+
+        * dfg/DFGDriver.h:
+        * dfg/DFGGraph.h:
+        appendBlock takes Ref&lt;&gt;&amp;&amp;.
+
+        (JSC::DFG::Graph::appendBlock):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::jitCode):
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::JITFinalizer):
+        Take Ref&lt;JITCode&gt;&amp;&amp;.
+
+        (JSC::DFG::JITFinalizer::finalize):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        (JSC::DFG::JITFinalizer::finalizeCommon):
+        Pass compilation reference since we already perform null check.
+
+        * dfg/DFGJITFinalizer.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::enqueue):
+        Take Ref&lt;Plan&gt;&amp;&amp;.
+
+        * dfg/DFGWorklist.h:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        Dereference and pass jitCode &amp; compilation references.
+
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::createJITStubRoutine):
+        Return Ref&lt;&gt; instead.
+
+        * jit/GCAwareJITStubRoutine.h:
+        (JSC::createJITStubRoutine):
+        * jit/JIT.cpp:
+        (JSC::JIT::link):
+        Pass compilation reference since we already perform null check.
+
+        * jit/JITStubRoutine.h:
+        (JSC::JITStubRoutine::asCodePtr):
+        Take Ref&lt;&gt;&amp;&amp; instead. And this drops unnecessary null check.
+
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        Pass Ref&lt;&gt; to NativeExecutable::create.
+
+        * llint/LLIntEntrypoint.cpp:
+        (JSC::LLInt::setFunctionEntrypoint):
+        (JSC::LLInt::setEvalEntrypoint):
+        (JSC::LLInt::setProgramEntrypoint):
+        (JSC::LLInt::setModuleProgramEntrypoint):
+        Use Ref&lt;&gt;&amp;&amp; instead.
+
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+        (JSC::SourceCode::subExpression):
+        Add constructors taking Ref&lt;&gt;&amp;&amp;.
+        We still have constructors that take RefPtr&lt;&gt;&amp;&amp;.
+        We will change it to Ref&lt;SourceProvider&gt;&amp;&amp; in https://bugs.webkit.org/show_bug.cgi?id=168325.
+
+        * parser/UnlinkedSourceCode.h:
+        (JSC::UnlinkedSourceCode::UnlinkedSourceCode):
+        Add constructors taking Ref&lt;&gt;&amp;&amp;.
+        We still have constructors that take RefPtr&lt;&gt;&amp;&amp;.
+        We will change it to Ref&lt;SourceProvider&gt;&amp;&amp; in https://bugs.webkit.org/show_bug.cgi?id=168325.
+
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::addCompilation):
+        Take Ref&lt;Compilation&gt;&amp;&amp;.
+
+        * profiler/ProfilerDatabase.h:
+        Change data structures to hold Ref&lt;&gt; instead of RefPtr&lt;&gt;.
+
+        * runtime/EvalExecutable.h:
+        (JSC::EvalExecutable::generatedJITCode):
+        Return Ref&lt;&gt; instead.
+
+        * runtime/ExecutableBase.h:
+        (JSC::ExecutableBase::generatedJITCodeForCall):
+        (JSC::ExecutableBase::generatedJITCodeForConstruct):
+        (JSC::ExecutableBase::generatedJITCodeFor):
+        Return Ref&lt;&gt; instead.
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::add8):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::setInputCursor):
+        And take Ref&lt;&gt; in this method.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::inputCursor):
+        Change m_inputCursor from RefPtr&lt;&gt; to Ref&lt;&gt;.
+
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::create):
+        (JSC::JSPropertyNameEnumerator::finishCreation):
+        Take Ref&lt;PropertyNameArray&gt;&amp;&amp;.
+
+        * runtime/JSPropertyNameEnumerator.h:
+        (JSC::propertyNameEnumerator):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        Take Ref&lt;StringImpl&gt;&amp;&amp; since we do not allow nullptr in this constructor.
+
+        (JSC::JSString::create):
+        (JSC::JSString::createHasOtherOwner):
+        Take Ref&lt;StringImpl&gt;&amp;&amp; in these factory functions. And drop unnecessary assertions.
+
+        (JSC::jsSingleCharacterString):
+        Use StringImpl::create() which returns Ref&lt;&gt;.
+
+        (JSC::jsNontrivialString):
+        Dereference impl() since we ensure that `s.length() &gt; 1`.
+
+        (JSC::jsString):
+        Use releaseNonNull() since we ensure that `s.length() &gt; 1`.
+
+        (JSC::jsOwnedString):
+        Use releaseNonNull() since we ensure that `s.length() &gt; 1`.
+
+        * runtime/ModuleProgramExecutable.h:
+        * runtime/NativeExecutable.cpp:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::finishCreation):
+        Take Ref&lt;JITCode&gt;&amp;&amp;.
+
+        * runtime/NativeExecutable.h:
+        * runtime/ProgramExecutable.h:
+        Return Ref&lt;JITCode&gt;.
+
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::releaseData):
+        (JSC::PropertyNameArray::setData): Deleted.
+        This is not used.
+
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::RegExpKey):
+        Take RefPtr&lt;&gt;&amp;&amp;.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::rep):
+        Return StringImpl&amp; since m_reps is already initialized in the constructor.
+
+        (JSC::SmallStrings::createEmptyString):
+        Dereference StringImpl::empty().
+
+        (JSC::SmallStrings::createSingleCharacterString):
+        Use StringImpl&amp;.
+
+        (JSC::SmallStrings::singleCharacterStringRep):
+        Return StringImpl&amp;.
+
+        (JSC::SmallStrings::initialize):
+        Use AtomicStringImpl::add instead.
+
+        * runtime/SmallStrings.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::toStructureShape):
+        Return Ref&lt;&gt;.
+
+        * runtime/Structure.h:
+        * runtime/TypeLocationCache.cpp:
+        (JSC::TypeLocationCache::getTypeLocation):
+        Take RefPtr&lt;TypeSet&gt;&amp;&amp;.
+
+        * runtime/TypeLocationCache.h:
+        * runtime/TypeProfilerLog.cpp:
+        Pass Ref&lt;&gt;&amp;&amp;.
+
+        (JSC::TypeProfilerLog::processLogEntries):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::addTypeInformation):
+        Take RefPtr&lt;&gt;&amp;&amp; since it can be nullptr.
+        And clean up &quot;not found&quot; code.
+
+        (JSC::TypeSet::allStructureRepresentations):
+        Use range based iteration.
+
+        (JSC::StructureShape::leastCommonAncestor):
+        We found that this method accidentally takes `const Vector&lt;&gt;` instead of `const Vector&lt;&gt;&amp;`.
+        And internally, we just use raw pointers since these StructureShapes are owned by the m_proto trees which starts from the given Vector&lt;&gt;.
+
+        (JSC::StructureShape::hasSamePrototypeChain):
+        Take const reference instead. And use raw pointers internally.
+
+        (JSC::StructureShape::merge):
+        Take Ref&lt;&gt;&amp;&amp;.
+
+        * runtime/TypeSet.h:
+        (JSC::StructureShape::setProto):
+        Take Ref&lt;&gt;&amp;&amp;.
+
+        * runtime/VM.cpp:
+        (JSC::VM::getHostFunction):
+        Pass Ref&lt;&gt;&amp;&amp;.
+
+        (JSC::VM::queueMicrotask):
+        Take and pass Ref&lt;&gt;&amp;&amp;.
+
+        * runtime/VM.h:
+        (JSC::QueuedTask::QueuedTask):
+        Take Ref&lt;&gt;&amp;&amp;.
+
+        * tools/FunctionOverrides.cpp:
+        (JSC::initializeOverrideInfo):
+        We need this change due to Ref&lt;&gt;&amp;&amp; and RefPtr&lt;&gt;&amp;&amp; ambiguity of SourceCode constructors.
+        Once SourceCode is fixed to only take Ref&lt;&gt;&amp;&amp;, this change is unnecessary.
+
</ins><span class="cx"> 2017-02-15  Csaba Osztrogonác  &lt;ossy@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         [Mac][cmake] Unreviewed trivial buildfix after r212169.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreassemblerLinkBuffercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/assembler/LinkBuffer.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/assembler/LinkBuffer.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/assembler/LinkBuffer.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -50,7 +50,7 @@
</span><span class="cx">     
</span><span class="cx">     ASSERT(m_didAllocate);
</span><span class="cx">     if (m_executableMemory)
</span><del>-        return CodeRef(m_executableMemory);
</del><ins>+        return CodeRef(*m_executableMemory);
</ins><span class="cx">     
</span><span class="cx">     return CodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(m_code));
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreassemblerMacroAssemblerCodeRefh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -27,7 +27,6 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;ExecutableAllocator.h&quot;
</span><span class="cx"> #include &lt;wtf/DataLog.h&gt;
</span><del>-#include &lt;wtf/PassRefPtr.h&gt;
</del><span class="cx"> #include &lt;wtf/PrintStream.h&gt;
</span><span class="cx"> #include &lt;wtf/RefPtr.h&gt;
</span><span class="cx"> #include &lt;wtf/text/CString.h&gt;
</span><span class="lines">@@ -354,9 +353,9 @@
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    MacroAssemblerCodeRef(PassRefPtr&lt;ExecutableMemoryHandle&gt; executableMemory)
</del><ins>+    MacroAssemblerCodeRef(Ref&lt;ExecutableMemoryHandle&gt;&amp;&amp; executableMemory)
</ins><span class="cx">         : m_codePtr(executableMemory-&gt;start())
</span><del>-        , m_executableMemory(executableMemory)
</del><ins>+        , m_executableMemory(WTFMove(executableMemory))
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(m_executableMemory-&gt;isManaged());
</span><span class="cx">         ASSERT(m_executableMemory-&gt;start());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCallLinkInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/bytecode/CallLinkInfo.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -207,10 +207,10 @@
</span><span class="cx">     void setExecutableDuringCompilation(ExecutableBase*);
</span><span class="cx">     ExecutableBase* executable();
</span><span class="cx">     
</span><del>-    void setStub(PassRefPtr&lt;PolymorphicCallStubRoutine&gt; newStub)
</del><ins>+    void setStub(Ref&lt;PolymorphicCallStubRoutine&gt;&amp;&amp; newStub)
</ins><span class="cx">     {
</span><span class="cx">         clearStub();
</span><del>-        m_stub = newStub;
</del><ins>+        m_stub = WTFMove(newStub);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void clearStub();
</span><span class="lines">@@ -220,9 +220,9 @@
</span><span class="cx">         return m_stub.get();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void setSlowStub(PassRefPtr&lt;JITStubRoutine&gt; newSlowStub)
</del><ins>+    void setSlowStub(Ref&lt;JITStubRoutine&gt;&amp;&amp; newSlowStub)
</ins><span class="cx">     {
</span><del>-        m_slowStub = newSlowStub;
</del><ins>+        m_slowStub = WTFMove(newSlowStub);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void clearSlowStub()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -1889,7 +1889,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> CodeBlock::CodeBlock(VM* vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock,
</span><del>-    JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
</del><ins>+    JSScope* scope, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
</ins><span class="cx">     : JSCell(*vm, structure)
</span><span class="cx">     , m_globalObject(scope-&gt;globalObject()-&gt;vm(), this, scope-&gt;globalObject())
</span><span class="cx">     , m_numCalleeLocals(unlinkedCodeBlock-&gt;m_numCalleeLocals)
</span><span class="lines">@@ -1912,7 +1912,7 @@
</span><span class="cx">     , m_vm(unlinkedCodeBlock-&gt;vm())
</span><span class="cx">     , m_thisRegister(unlinkedCodeBlock-&gt;thisRegister())
</span><span class="cx">     , m_scopeRegister(unlinkedCodeBlock-&gt;scopeRegister())
</span><del>-    , m_source(sourceProvider)
</del><ins>+    , m_source(WTFMove(sourceProvider))
</ins><span class="cx">     , m_sourceOffset(sourceOffset)
</span><span class="cx">     , m_firstLineColumnOffset(firstLineColumnOffset)
</span><span class="cx">     , m_osrExitCounter(0)
</span><span class="lines">@@ -2304,7 +2304,7 @@
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="cx">             std::pair&lt;TypeLocation*, bool&gt; locationPair = vm.typeProfiler()-&gt;typeLocationCache()-&gt;getTypeLocation(globalVariableID,
</span><del>-                ownerExecutable-&gt;sourceID(), divotStart, divotEnd, globalTypeSet, &amp;vm);
</del><ins>+                ownerExecutable-&gt;sourceID(), divotStart, divotEnd, WTFMove(globalTypeSet), &amp;vm);
</ins><span class="cx">             TypeLocation* location = locationPair.first;
</span><span class="cx">             bool isNewLocation = locationPair.second;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -118,7 +118,7 @@
</span><span class="cx"> 
</span><span class="cx"> protected:
</span><span class="cx">     CodeBlock(VM*, Structure*, CopyParsedBlockTag, CodeBlock&amp; other);
</span><del>-    CodeBlock(VM*, Structure*, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*, PassRefPtr&lt;SourceProvider&gt;, unsigned sourceOffset, unsigned firstLineColumnOffset);
</del><ins>+    CodeBlock(VM*, Structure*, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*, RefPtr&lt;SourceProvider&gt;&amp;&amp;, unsigned sourceOffset, unsigned firstLineColumnOffset);
</ins><span class="cx"> 
</span><span class="cx">     void finishCreation(VM&amp;, CopyParsedBlockTag, CodeBlock&amp; other);
</span><span class="cx">     void finishCreation(VM&amp;, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*);
</span><span class="lines">@@ -312,15 +312,15 @@
</span><span class="cx">     // Exactly equivalent to codeBlock-&gt;ownerExecutable()-&gt;newReplacementCodeBlockFor(codeBlock-&gt;specializationKind())
</span><span class="cx">     CodeBlock* newReplacement();
</span><span class="cx">     
</span><del>-    void setJITCode(PassRefPtr&lt;JITCode&gt; code)
</del><ins>+    void setJITCode(Ref&lt;JITCode&gt;&amp;&amp; code)
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(heap()-&gt;isDeferred());
</span><span class="cx">         heap()-&gt;reportExtraMemoryAllocated(code-&gt;size());
</span><span class="cx">         ConcurrentJSLocker locker(m_lock);
</span><span class="cx">         WTF::storeStoreFence(); // This is probably not needed because the lock will also do something similar, but it's good to be paranoid.
</span><del>-        m_jitCode = code;
</del><ins>+        m_jitCode = WTFMove(code);
</ins><span class="cx">     }
</span><del>-    PassRefPtr&lt;JITCode&gt; jitCode() { return m_jitCode; }
</del><ins>+    RefPtr&lt;JITCode&gt; jitCode() { return m_jitCode; }
</ins><span class="cx">     static ptrdiff_t jitCodeOffset() { return OBJECT_OFFSETOF(CodeBlock, m_jitCode); }
</span><span class="cx">     JITCode::JITType jitType() const
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeEvalCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/EvalCodeBlock.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/EvalCodeBlock.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/bytecode/EvalCodeBlock.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -47,10 +47,10 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static EvalCodeBlock* create(VM* vm, EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock,
</span><del>-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider)
</del><ins>+        JSScope* scope, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceProvider)
</ins><span class="cx">     {
</span><span class="cx">         EvalCodeBlock* instance = new (NotNull, allocateCell&lt;EvalCodeBlock&gt;(vm-&gt;heap))
</span><del>-            EvalCodeBlock(vm, vm-&gt;evalCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider);
</del><ins>+            EvalCodeBlock(vm, vm-&gt;evalCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider));
</ins><span class="cx">         instance-&gt;finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
</span><span class="cx">         return instance;
</span><span class="cx">     }
</span><span class="lines">@@ -70,8 +70,8 @@
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="cx">     EvalCodeBlock(VM* vm, Structure* structure, EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock,
</span><del>-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider)
-        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, 1)
</del><ins>+        JSScope* scope, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceProvider)
+        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), 0, 1)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeFunctionCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -48,10 +48,10 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static FunctionCodeBlock* create(VM* vm, FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSScope* scope,
</span><del>-        PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
</del><ins>+        RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
</ins><span class="cx">     {
</span><span class="cx">         FunctionCodeBlock* instance = new (NotNull, allocateCell&lt;FunctionCodeBlock&gt;(vm-&gt;heap))
</span><del>-            FunctionCodeBlock(vm, vm-&gt;functionCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset);
</del><ins>+            FunctionCodeBlock(vm, vm-&gt;functionCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), sourceOffset, firstLineColumnOffset);
</ins><span class="cx">         instance-&gt;finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
</span><span class="cx">         return instance;
</span><span class="cx">     }
</span><span class="lines">@@ -68,8 +68,8 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     FunctionCodeBlock(VM* vm, Structure* structure, FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSScope* scope,
</span><del>-        PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
-        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset)
</del><ins>+        RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), sourceOffset, firstLineColumnOffset)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGlobalCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -45,8 +45,8 @@
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    GlobalCodeBlock(VM* vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
-        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset)
</del><ins>+    GlobalCodeBlock(VM* vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), sourceOffset, firstLineColumnOffset)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeModuleProgramCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -48,10 +48,10 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static ModuleProgramCodeBlock* create(VM* vm, ModuleProgramExecutable* ownerExecutable, UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock,
</span><del>-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned firstLineColumnOffset)
</del><ins>+        JSScope* scope, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceProvider, unsigned firstLineColumnOffset)
</ins><span class="cx">     {
</span><span class="cx">         ModuleProgramCodeBlock* instance = new (NotNull, allocateCell&lt;ModuleProgramCodeBlock&gt;(vm-&gt;heap))
</span><del>-            ModuleProgramCodeBlock(vm, vm-&gt;moduleProgramCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, firstLineColumnOffset);
</del><ins>+            ModuleProgramCodeBlock(vm, vm-&gt;moduleProgramCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), firstLineColumnOffset);
</ins><span class="cx">         instance-&gt;finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
</span><span class="cx">         return instance;
</span><span class="cx">     }
</span><span class="lines">@@ -68,8 +68,8 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     ModuleProgramCodeBlock(VM* vm, Structure* structure, ModuleProgramExecutable* ownerExecutable, UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock,
</span><del>-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned firstLineColumnOffset)
-        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, firstLineColumnOffset)
</del><ins>+        JSScope* scope, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceProvider, unsigned firstLineColumnOffset)
+        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), 0, firstLineColumnOffset)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeProgramCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -48,10 +48,10 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static ProgramCodeBlock* create(VM* vm, ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock,
</span><del>-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned firstLineColumnOffset)
</del><ins>+        JSScope* scope, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceProvider, unsigned firstLineColumnOffset)
</ins><span class="cx">     {
</span><span class="cx">         ProgramCodeBlock* instance = new (NotNull, allocateCell&lt;ProgramCodeBlock&gt;(vm-&gt;heap))
</span><del>-            ProgramCodeBlock(vm, vm-&gt;programCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, firstLineColumnOffset);
</del><ins>+            ProgramCodeBlock(vm, vm-&gt;programCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), firstLineColumnOffset);
</ins><span class="cx">         instance-&gt;finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
</span><span class="cx">         return instance;
</span><span class="cx">     }
</span><span class="lines">@@ -68,8 +68,8 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     ProgramCodeBlock(VM* vm, Structure* structure, ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock,
</span><del>-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned firstLineColumnOffset)
-        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, firstLineColumnOffset)
</del><ins>+        JSScope* scope, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceProvider, unsigned firstLineColumnOffset)
+        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, WTFMove(sourceProvider), 0, firstLineColumnOffset)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerParseDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/debugger/DebuggerParseData.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerParseData.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerParseData.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -167,9 +167,10 @@
</span><span class="cx"> 
</span><span class="cx"> bool gatherDebuggerParseDataForSource(VM&amp; vm, SourceProvider* provider, DebuggerParseData&amp; debuggerParseData)
</span><span class="cx"> {
</span><ins>+    ASSERT(provider);
</ins><span class="cx">     int startLine = provider-&gt;startPosition().m_line.oneBasedInt();
</span><span class="cx">     int startColumn = provider-&gt;startPosition().m_column.oneBasedInt();
</span><del>-    SourceCode completeSource(provider, startLine, startColumn);
</del><ins>+    SourceCode completeSource(*provider, startLine, startColumn);
</ins><span class="cx"> 
</span><span class="cx">     switch (provider-&gt;sourceType()) {
</span><span class="cx">     case SourceProviderSourceType::Program:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBlockInsertionSetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -44,21 +44,22 @@
</span><span class="cx">     m_insertions.append(insertion);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void BlockInsertionSet::insert(size_t index, PassRefPtr&lt;BasicBlock&gt; block)
</del><ins>+void BlockInsertionSet::insert(size_t index, Ref&lt;BasicBlock&gt;&amp;&amp; block)
</ins><span class="cx"> {
</span><del>-    insert(BlockInsertion(index, block));
</del><ins>+    insert(BlockInsertion(index, WTFMove(block)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> BasicBlock* BlockInsertionSet::insert(size_t index, float executionCount)
</span><span class="cx"> {
</span><del>-    RefPtr&lt;BasicBlock&gt; block = adoptRef(new BasicBlock(
</del><ins>+    Ref&lt;BasicBlock&gt; block = adoptRef(*new BasicBlock(
</ins><span class="cx">         UINT_MAX,
</span><span class="cx">         m_graph.block(0)-&gt;variablesAtHead.numberOfArguments(),
</span><span class="cx">         m_graph.block(0)-&gt;variablesAtHead.numberOfLocals(),
</span><span class="cx">         executionCount));
</span><span class="cx">     block-&gt;isReachable = true;
</span><del>-    insert(index, block);
-    return block.get();
</del><ins>+    auto* result = block.ptr();
+    insert(index, WTFMove(block));
+    return result;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> BasicBlock* BlockInsertionSet::insertBefore(BasicBlock* before, float executionCount)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBlockInsertionSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/dfg/DFGBlockInsertionSet.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     ~BlockInsertionSet();
</span><span class="cx">     
</span><span class="cx">     void insert(const BlockInsertion&amp;);
</span><del>-    void insert(size_t index, PassRefPtr&lt;BasicBlock&gt;);
</del><ins>+    void insert(size_t index, Ref&lt;BasicBlock&gt;&amp;&amp;);
</ins><span class="cx">     BasicBlock* insert(size_t index, float executionCount);
</span><span class="cx">     BasicBlock* insertBefore(BasicBlock* before, float executionCount);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -1629,7 +1629,7 @@
</span><span class="cx">     ASSERT(lastBlock-&gt;terminal());
</span><span class="cx"> 
</span><span class="cx">     // Need to create a new basic block for the continuation at the caller.
</span><del>-    RefPtr&lt;BasicBlock&gt; block = adoptRef(new BasicBlock(nextOffset, m_numArguments, m_numLocals, 1));
</del><ins>+    Ref&lt;BasicBlock&gt; block = adoptRef(*new BasicBlock(nextOffset, m_numArguments, m_numLocals, 1));
</ins><span class="cx"> 
</span><span class="cx">     // Link the early returns to the basic block we're about to create.
</span><span class="cx">     for (size_t i = 0; i &lt; inlineStackEntry.m_unlinkedBlocks.size(); ++i) {
</span><span class="lines">@@ -1640,7 +1640,7 @@
</span><span class="cx">         Node* node = blockToLink-&gt;terminal();
</span><span class="cx">         ASSERT(node-&gt;op() == Jump);
</span><span class="cx">         ASSERT(!node-&gt;targetBlock());
</span><del>-        node-&gt;targetBlock() = block.get();
</del><ins>+        node-&gt;targetBlock() = block.ptr();
</ins><span class="cx">         inlineStackEntry.m_unlinkedBlocks[i].m_needsEarlyReturnLinking = false;
</span><span class="cx">         if (verbose)
</span><span class="cx">             dataLog(&quot;Marking &quot;, RawPointer(blockToLink), &quot; as linked (jumps to return)\n&quot;);
</span><span class="lines">@@ -1647,15 +1647,15 @@
</span><span class="cx">         blockToLink-&gt;didLink();
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    m_currentBlock = block.get();
</del><ins>+    m_currentBlock = block.ptr();
</ins><span class="cx">     ASSERT(m_inlineStackTop-&gt;m_caller-&gt;m_blockLinkingTargets.isEmpty() || m_inlineStackTop-&gt;m_caller-&gt;m_blockLinkingTargets.last()-&gt;bytecodeBegin &lt; nextOffset);
</span><span class="cx">     if (verbose)
</span><del>-        dataLog(&quot;Adding unlinked block &quot;, RawPointer(block.get()), &quot; (many returns)\n&quot;);
</del><ins>+        dataLog(&quot;Adding unlinked block &quot;, RawPointer(block.ptr()), &quot; (many returns)\n&quot;);
</ins><span class="cx">     if (callerLinkability == CallerDoesNormalLinking) {
</span><del>-        m_inlineStackTop-&gt;m_caller-&gt;m_unlinkedBlocks.append(UnlinkedBlock(block.get()));
-        m_inlineStackTop-&gt;m_caller-&gt;m_blockLinkingTargets.append(block.get());
</del><ins>+        m_inlineStackTop-&gt;m_caller-&gt;m_unlinkedBlocks.append(UnlinkedBlock(block.ptr()));
+        m_inlineStackTop-&gt;m_caller-&gt;m_blockLinkingTargets.append(block.ptr());
</ins><span class="cx">     }
</span><del>-    m_graph.appendBlock(block);
</del><ins>+    m_graph.appendBlock(WTFMove(block));
</ins><span class="cx">     prepareToParseBlock();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -2002,9 +2002,9 @@
</span><span class="cx">     
</span><span class="cx">     for (unsigned i = 0; i &lt; callLinkStatus.size(); ++i) {
</span><span class="cx">         m_currentIndex = oldOffset;
</span><del>-        RefPtr&lt;BasicBlock&gt; block = adoptRef(new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
-        m_currentBlock = block.get();
-        m_graph.appendBlock(block);
</del><ins>+        Ref&lt;BasicBlock&gt; block = adoptRef(*new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
+        m_currentBlock = block.ptr();
+        m_graph.appendBlock(block.copyRef());
</ins><span class="cx">         prepareToParseBlock();
</span><span class="cx">         
</span><span class="cx">         Node* myCallTargetNode = getDirect(calleeReg);
</span><span class="lines">@@ -2017,9 +2017,9 @@
</span><span class="cx">         if (!inliningResult) {
</span><span class="cx">             // That failed so we let the block die. Nothing interesting should have been added to
</span><span class="cx">             // the block. We also give up on inlining any of the (less frequent) callees.
</span><del>-            ASSERT(m_currentBlock == block.get());
-            ASSERT(m_graph.m_blocks.last() == block);
-            m_graph.killBlockAndItsContents(block.get());
</del><ins>+            ASSERT(m_currentBlock == block.ptr());
+            ASSERT(m_graph.m_blocks.last() == block.ptr());
+            m_graph.killBlockAndItsContents(block.ptr());
</ins><span class="cx">             m_graph.m_blocks.removeLast();
</span><span class="cx">             
</span><span class="cx">             // The fact that inlining failed means we need a slow path.
</span><span class="lines">@@ -2034,7 +2034,7 @@
</span><span class="cx">             ASSERT(allAreClosureCalls);
</span><span class="cx">             thingToCaseOn = callLinkStatus[i].executable();
</span><span class="cx">         }
</span><del>-        data.cases.append(SwitchCase(m_graph.freeze(thingToCaseOn), block.get()));
</del><ins>+        data.cases.append(SwitchCase(m_graph.freeze(thingToCaseOn), block.ptr()));
</ins><span class="cx">         m_currentIndex = nextOffset;
</span><span class="cx">         m_exitOK = true;
</span><span class="cx">         processSetLocalQueue(); // This only comes into play for intrinsics, since normal inlined code will leave an empty queue.
</span><span class="lines">@@ -2052,17 +2052,17 @@
</span><span class="cx">             dataLog(&quot;Finished inlining &quot;, callLinkStatus[i], &quot; at &quot;, currentCodeOrigin(), &quot;.\n&quot;);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    RefPtr&lt;BasicBlock&gt; slowPathBlock = adoptRef(
-        new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
</del><ins>+    Ref&lt;BasicBlock&gt; slowPathBlock = adoptRef(
+        *new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
</ins><span class="cx">     m_currentIndex = oldOffset;
</span><span class="cx">     m_exitOK = true;
</span><del>-    data.fallThrough = BranchTarget(slowPathBlock.get());
-    m_graph.appendBlock(slowPathBlock);
</del><ins>+    data.fallThrough = BranchTarget(slowPathBlock.ptr());
+    m_graph.appendBlock(slowPathBlock.copyRef());
</ins><span class="cx">     if (verbose)
</span><del>-        dataLog(&quot;Marking &quot;, RawPointer(slowPathBlock.get()), &quot; as linked (slow path block)\n&quot;);
</del><ins>+        dataLog(&quot;Marking &quot;, RawPointer(slowPathBlock.ptr()), &quot; as linked (slow path block)\n&quot;);
</ins><span class="cx">     slowPathBlock-&gt;didLink();
</span><span class="cx">     prepareToParseBlock();
</span><del>-    m_currentBlock = slowPathBlock.get();
</del><ins>+    m_currentBlock = slowPathBlock.ptr();
</ins><span class="cx">     Node* myCallTargetNode = getDirect(calleeReg);
</span><span class="cx">     if (couldTakeSlowPath) {
</span><span class="cx">         addCall(
</span><span class="lines">@@ -2086,17 +2086,17 @@
</span><span class="cx">         landingBlocks.append(m_currentBlock);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    RefPtr&lt;BasicBlock&gt; continuationBlock = adoptRef(
-        new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
-    m_graph.appendBlock(continuationBlock);
</del><ins>+    Ref&lt;BasicBlock&gt; continuationBlock = adoptRef(
+        *new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
+    m_graph.appendBlock(continuationBlock.copyRef());
</ins><span class="cx">     if (verbose)
</span><del>-        dataLog(&quot;Adding unlinked block &quot;, RawPointer(continuationBlock.get()), &quot; (continuation)\n&quot;);
-    m_inlineStackTop-&gt;m_unlinkedBlocks.append(UnlinkedBlock(continuationBlock.get()));
</del><ins>+        dataLog(&quot;Adding unlinked block &quot;, RawPointer(continuationBlock.ptr()), &quot; (continuation)\n&quot;);
+    m_inlineStackTop-&gt;m_unlinkedBlocks.append(UnlinkedBlock(continuationBlock.ptr()));
</ins><span class="cx">     prepareToParseBlock();
</span><del>-    m_currentBlock = continuationBlock.get();
</del><ins>+    m_currentBlock = continuationBlock.ptr();
</ins><span class="cx">     
</span><span class="cx">     for (unsigned i = landingBlocks.size(); i--;)
</span><del>-        landingBlocks[i]-&gt;terminal()-&gt;targetBlock() = continuationBlock.get();
</del><ins>+        landingBlocks[i]-&gt;terminal()-&gt;targetBlock() = continuationBlock.ptr();
</ins><span class="cx">     
</span><span class="cx">     m_currentIndex = oldOffset;
</span><span class="cx">     m_exitOK = true;
</span><span class="lines">@@ -5817,8 +5817,8 @@
</span><span class="cx">                     m_currentBlock = m_graph.lastBlock();
</span><span class="cx">                     m_currentBlock-&gt;bytecodeBegin = m_currentIndex;
</span><span class="cx">                 } else {
</span><del>-                    RefPtr&lt;BasicBlock&gt; block = adoptRef(new BasicBlock(m_currentIndex, m_numArguments, m_numLocals, 1));
-                    m_currentBlock = block.get();
</del><ins>+                    Ref&lt;BasicBlock&gt; block = adoptRef(*new BasicBlock(m_currentIndex, m_numArguments, m_numLocals, 1));
+                    m_currentBlock = block.ptr();
</ins><span class="cx">                     // This assertion checks two things:
</span><span class="cx">                     // 1) If the bytecodeBegin is greater than currentIndex, then something has gone
</span><span class="cx">                     //    horribly wrong. So, we're probably generating incorrect code.
</span><span class="lines">@@ -5831,12 +5831,12 @@
</span><span class="cx">                         ASSERT_UNUSED(
</span><span class="cx">                             lastBegin, lastBegin == UINT_MAX || lastBegin &lt; m_currentIndex);
</span><span class="cx">                     }
</span><del>-                    m_inlineStackTop-&gt;m_unlinkedBlocks.append(UnlinkedBlock(block.get()));
-                    m_inlineStackTop-&gt;m_blockLinkingTargets.append(block.get());
</del><ins>+                    m_inlineStackTop-&gt;m_unlinkedBlocks.append(UnlinkedBlock(block.ptr()));
+                    m_inlineStackTop-&gt;m_blockLinkingTargets.append(block.ptr());
</ins><span class="cx">                     // The first block is definitely an OSR target.
</span><span class="cx">                     if (!m_graph.numBlocks())
</span><span class="cx">                         block-&gt;isOSRTarget = true;
</span><del>-                    m_graph.appendBlock(block);
</del><ins>+                    m_graph.appendBlock(WTFMove(block));
</ins><span class="cx">                     prepareToParseBlock();
</span><span class="cx">                 }
</span><span class="cx">             }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDrivercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx"> static CompilationResult compileImpl(
</span><span class="cx">     VM&amp; vm, CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationMode mode,
</span><span class="cx">     unsigned osrEntryBytecodeIndex, const Operands&lt;JSValue&gt;&amp; mustHandleValues,
</span><del>-    PassRefPtr&lt;DeferredCompilationCallback&gt; callback)
</del><ins>+    Ref&lt;DeferredCompilationCallback&gt;&amp;&amp; callback)
</ins><span class="cx"> {
</span><span class="cx">     if (!Options::bytecodeRangeToDFGCompile().isInRange(codeBlock-&gt;instructionCount())
</span><span class="cx">         || !ensureGlobalDFGWhitelist().contains(codeBlock))
</span><span class="lines">@@ -96,15 +96,15 @@
</span><span class="cx">     if (vm.typeProfiler())
</span><span class="cx">         vm.typeProfilerLog()-&gt;processLogEntries(ASCIILiteral(&quot;Preparing for DFG compilation.&quot;));
</span><span class="cx">     
</span><del>-    RefPtr&lt;Plan&gt; plan = adoptRef(
-        new Plan(codeBlock, profiledDFGCodeBlock, mode, osrEntryBytecodeIndex, mustHandleValues));
</del><ins>+    Ref&lt;Plan&gt; plan = adoptRef(
+        *new Plan(codeBlock, profiledDFGCodeBlock, mode, osrEntryBytecodeIndex, mustHandleValues));
</ins><span class="cx">     
</span><del>-    plan-&gt;callback = callback;
</del><ins>+    plan-&gt;callback = WTFMove(callback);
</ins><span class="cx">     if (Options::useConcurrentJIT()) {
</span><span class="cx">         Worklist&amp; worklist = ensureGlobalWorklistFor(mode);
</span><span class="cx">         if (logCompilationChanges(mode))
</span><span class="cx">             dataLog(&quot;Deferring DFG compilation of &quot;, *codeBlock, &quot; with queue length &quot;, worklist.queueLength(), &quot;.\n&quot;);
</span><del>-        worklist.enqueue(plan);
</del><ins>+        worklist.enqueue(WTFMove(plan));
</ins><span class="cx">         return CompilationDeferred;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -114,7 +114,7 @@
</span><span class="cx"> #else // ENABLE(DFG_JIT)
</span><span class="cx"> static CompilationResult compileImpl(
</span><span class="cx">     VM&amp;, CodeBlock*, CodeBlock*, CompilationMode, unsigned, const Operands&lt;JSValue&gt;&amp;,
</span><del>-    PassRefPtr&lt;DeferredCompilationCallback&gt;)
</del><ins>+    Ref&lt;DeferredCompilationCallback&gt;&amp;&amp;)
</ins><span class="cx"> {
</span><span class="cx">     return CompilationFailed;
</span><span class="cx"> }
</span><span class="lines">@@ -123,12 +123,11 @@
</span><span class="cx"> CompilationResult compile(
</span><span class="cx">     VM&amp; vm, CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationMode mode,
</span><span class="cx">     unsigned osrEntryBytecodeIndex, const Operands&lt;JSValue&gt;&amp; mustHandleValues,
</span><del>-    PassRefPtr&lt;DeferredCompilationCallback&gt; passedCallback)
</del><ins>+    Ref&lt;DeferredCompilationCallback&gt;&amp;&amp; callback)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;DeferredCompilationCallback&gt; callback = passedCallback;
</del><span class="cx">     CompilationResult result = compileImpl(
</span><span class="cx">         vm, codeBlock, profiledDFGCodeBlock, mode, osrEntryBytecodeIndex, mustHandleValues,
</span><del>-        callback);
</del><ins>+        callback.copyRef());
</ins><span class="cx">     if (result != CompilationDeferred)
</span><span class="cx">         callback-&gt;compilationDidComplete(codeBlock, profiledDFGCodeBlock, result);
</span><span class="cx">     return result;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDriverh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDriver.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDriver.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/dfg/DFGDriver.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -45,6 +45,6 @@
</span><span class="cx"> CompilationResult compile(
</span><span class="cx">     VM&amp;, CodeBlock*, CodeBlock* profiledDFGCodeBlock, CompilationMode,
</span><span class="cx">     unsigned osrEntryBytecodeIndex, const Operands&lt;JSValue&gt;&amp; mustHandleValues,
</span><del>-    PassRefPtr&lt;DeferredCompilationCallback&gt;);
</del><ins>+    Ref&lt;DeferredCompilationCallback&gt;&amp;&amp;);
</ins><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::DFG
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -442,10 +442,10 @@
</span><span class="cx">     BasicBlock* block(BlockIndex blockIndex) const { return m_blocks[blockIndex].get(); }
</span><span class="cx">     BasicBlock* lastBlock() const { return block(numBlocks() - 1); }
</span><span class="cx"> 
</span><del>-    void appendBlock(PassRefPtr&lt;BasicBlock&gt; basicBlock)
</del><ins>+    void appendBlock(Ref&lt;BasicBlock&gt;&amp;&amp; basicBlock)
</ins><span class="cx">     {
</span><span class="cx">         basicBlock-&gt;index = m_blocks.size();
</span><del>-        m_blocks.append(basicBlock);
</del><ins>+        m_blocks.append(WTFMove(basicBlock));
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     void killBlock(BlockIndex blockIndex)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGJITCompilercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -407,7 +407,7 @@
</span><span class="cx">     disassemble(*linkBuffer);
</span><span class="cx">     
</span><span class="cx">     m_graph.m_plan.finalizer = std::make_unique&lt;JITFinalizer&gt;(
</span><del>-        m_graph.m_plan, WTFMove(m_jitCode), WTFMove(linkBuffer));
</del><ins>+        m_graph.m_plan, m_jitCode.releaseNonNull(), WTFMove(linkBuffer));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JITCompiler::compileFunction()
</span><span class="lines">@@ -504,7 +504,7 @@
</span><span class="cx">     MacroAssemblerCodePtr withArityCheck = linkBuffer-&gt;locationOf(m_arityCheck);
</span><span class="cx"> 
</span><span class="cx">     m_graph.m_plan.finalizer = std::make_unique&lt;JITFinalizer&gt;(
</span><del>-        m_graph.m_plan, WTFMove(m_jitCode), WTFMove(linkBuffer), withArityCheck);
</del><ins>+        m_graph.m_plan, m_jitCode.releaseNonNull(), WTFMove(linkBuffer), withArityCheck);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JITCompiler::disassemble(LinkBuffer&amp; linkBuffer)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGJITFinalizercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -37,9 +37,9 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx"> 
</span><del>-JITFinalizer::JITFinalizer(Plan&amp; plan, PassRefPtr&lt;JITCode&gt; jitCode, std::unique_ptr&lt;LinkBuffer&gt; linkBuffer, MacroAssemblerCodePtr withArityCheck)
</del><ins>+JITFinalizer::JITFinalizer(Plan&amp; plan, Ref&lt;JITCode&gt;&amp;&amp; jitCode, std::unique_ptr&lt;LinkBuffer&gt; linkBuffer, MacroAssemblerCodePtr withArityCheck)
</ins><span class="cx">     : Finalizer(plan)
</span><del>-    , m_jitCode(jitCode)
</del><ins>+    , m_jitCode(WTFMove(jitCode))
</ins><span class="cx">     , m_linkBuffer(WTFMove(linkBuffer))
</span><span class="cx">     , m_withArityCheck(withArityCheck)
</span><span class="cx"> {
</span><span class="lines">@@ -60,7 +60,7 @@
</span><span class="cx">         FINALIZE_DFG_CODE(*m_linkBuffer, (&quot;DFG JIT code for %s&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::DFGJIT)).data())),
</span><span class="cx">         MacroAssemblerCodePtr());
</span><span class="cx">     
</span><del>-    m_plan.codeBlock-&gt;setJITCode(m_jitCode);
</del><ins>+    m_plan.codeBlock-&gt;setJITCode(m_jitCode.copyRef());
</ins><span class="cx">     
</span><span class="cx">     finalizeCommon();
</span><span class="cx">     
</span><span class="lines">@@ -73,7 +73,7 @@
</span><span class="cx">     m_jitCode-&gt;initializeCodeRef(
</span><span class="cx">         FINALIZE_DFG_CODE(*m_linkBuffer, (&quot;DFG JIT code for %s&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::DFGJIT)).data())),
</span><span class="cx">         m_withArityCheck);
</span><del>-    m_plan.codeBlock-&gt;setJITCode(m_jitCode);
</del><ins>+    m_plan.codeBlock-&gt;setJITCode(m_jitCode.copyRef());
</ins><span class="cx">     
</span><span class="cx">     finalizeCommon();
</span><span class="cx">     
</span><span class="lines">@@ -91,7 +91,7 @@
</span><span class="cx"> #endif // ENABLE(FTL_JIT)
</span><span class="cx">     
</span><span class="cx">     if (m_plan.compilation)
</span><del>-        m_plan.vm-&gt;m_perBytecodeProfiler-&gt;addCompilation(m_plan.codeBlock, m_plan.compilation);
</del><ins>+        m_plan.vm-&gt;m_perBytecodeProfiler-&gt;addCompilation(m_plan.codeBlock, *m_plan.compilation);
</ins><span class="cx">     
</span><span class="cx">     if (!m_plan.willTryToTierUp)
</span><span class="cx">         m_plan.codeBlock-&gt;baselineVersion()-&gt;m_didFailFTLCompilation = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGJITFinalizerh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> 
</span><span class="cx"> class JITFinalizer : public Finalizer {
</span><span class="cx"> public:
</span><del>-    JITFinalizer(Plan&amp;, PassRefPtr&lt;JITCode&gt;, std::unique_ptr&lt;LinkBuffer&gt;, MacroAssemblerCodePtr withArityCheck = MacroAssemblerCodePtr(MacroAssemblerCodePtr::EmptyValue));
</del><ins>+    JITFinalizer(Plan&amp;, Ref&lt;JITCode&gt;&amp;&amp;, std::unique_ptr&lt;LinkBuffer&gt;, MacroAssemblerCodePtr withArityCheck = MacroAssemblerCodePtr(MacroAssemblerCodePtr::EmptyValue));
</ins><span class="cx">     virtual ~JITFinalizer();
</span><span class="cx">     
</span><span class="cx">     size_t codeSize() override;
</span><span class="lines">@@ -46,7 +46,7 @@
</span><span class="cx"> private:
</span><span class="cx">     void finalizeCommon();
</span><span class="cx">     
</span><del>-    RefPtr&lt;JITCode&gt; m_jitCode;
</del><ins>+    Ref&lt;JITCode&gt; m_jitCode;
</ins><span class="cx">     std::unique_ptr&lt;LinkBuffer&gt; m_linkBuffer;
</span><span class="cx">     MacroAssemblerCodePtr m_withArityCheck;
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWorklistcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -223,9 +223,8 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Worklist::enqueue(PassRefPtr&lt;Plan&gt; passedPlan)
</del><ins>+void Worklist::enqueue(Ref&lt;Plan&gt;&amp;&amp; plan)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;Plan&gt; plan = passedPlan;
</del><span class="cx">     LockHolder locker(*m_lock);
</span><span class="cx">     if (Options::verboseCompilationQueue()) {
</span><span class="cx">         dump(locker, WTF::dataFile());
</span><span class="lines">@@ -232,8 +231,8 @@
</span><span class="cx">         dataLog(&quot;: Enqueueing plan to optimize &quot;, plan-&gt;key(), &quot;\n&quot;);
</span><span class="cx">     }
</span><span class="cx">     ASSERT(m_plans.find(plan-&gt;key()) == m_plans.end());
</span><del>-    m_plans.add(plan-&gt;key(), plan);
-    m_queue.append(plan);
</del><ins>+    m_plans.add(plan-&gt;key(), plan.copyRef());
+    m_queue.append(WTFMove(plan));
</ins><span class="cx">     m_planEnqueued-&gt;notifyOne(locker);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWorklisth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGWorklist.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWorklist.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/dfg/DFGWorklist.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -50,7 +50,7 @@
</span><span class="cx">     
</span><span class="cx">     static Ref&lt;Worklist&gt; create(CString worklistName, unsigned numberOfThreads, int relativePriority = 0);
</span><span class="cx">     
</span><del>-    void enqueue(PassRefPtr&lt;Plan&gt;);
</del><ins>+    void enqueue(Ref&lt;Plan&gt;&amp;&amp;);
</ins><span class="cx">     
</span><span class="cx">     // This is equivalent to:
</span><span class="cx">     // worklist-&gt;waitUntilAllPlansForVMAreReady(vm);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLJITFinalizercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -81,10 +81,10 @@
</span><span class="cx">             dumpDisassembly, *entrypointLinkBuffer,
</span><span class="cx">             (&quot;FTL entrypoint thunk for %s with B3 generated code at %p&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::FTLJIT)).data(), function)));
</span><span class="cx">     
</span><del>-    m_plan.codeBlock-&gt;setJITCode(jitCode);
</del><ins>+    m_plan.codeBlock-&gt;setJITCode(*jitCode);
</ins><span class="cx"> 
</span><span class="cx">     if (m_plan.compilation)
</span><del>-        m_plan.vm-&gt;m_perBytecodeProfiler-&gt;addCompilation(m_plan.codeBlock, m_plan.compilation);
</del><ins>+        m_plan.vm-&gt;m_perBytecodeProfiler-&gt;addCompilation(m_plan.codeBlock, *m_plan.compilation);
</ins><span class="cx">     
</span><span class="cx">     return true;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitGCAwareJITStubRoutinecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -132,7 +132,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;JITStubRoutine&gt; createJITStubRoutine(
</del><ins>+Ref&lt;JITStubRoutine&gt; createJITStubRoutine(
</ins><span class="cx">     const MacroAssemblerCodeRef&amp; code,
</span><span class="cx">     VM&amp; vm,
</span><span class="cx">     const JSCell* owner,
</span><span class="lines">@@ -142,17 +142,17 @@
</span><span class="cx">     CallSiteIndex exceptionHandlerCallSiteIndex)
</span><span class="cx"> {
</span><span class="cx">     if (!makesCalls)
</span><del>-        return adoptRef(new JITStubRoutine(code));
</del><ins>+        return adoptRef(*new JITStubRoutine(code));
</ins><span class="cx">     
</span><span class="cx">     if (codeBlockForExceptionHandlers) {
</span><span class="cx">         RELEASE_ASSERT(JITCode::isOptimizingJIT(codeBlockForExceptionHandlers-&gt;jitType()));
</span><del>-        return adoptRef(new GCAwareJITStubRoutineWithExceptionHandler(code, vm, owner, cells, codeBlockForExceptionHandlers, exceptionHandlerCallSiteIndex));
</del><ins>+        return adoptRef(*new GCAwareJITStubRoutineWithExceptionHandler(code, vm, owner, cells, codeBlockForExceptionHandlers, exceptionHandlerCallSiteIndex));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (cells.isEmpty())
</span><del>-        return adoptRef(new GCAwareJITStubRoutine(code, vm));
</del><ins>+        return adoptRef(*new GCAwareJITStubRoutine(code, vm));
</ins><span class="cx">     
</span><del>-    return adoptRef(new MarkingGCAwareJITStubRoutine(code, vm, owner, cells));
</del><ins>+    return adoptRef(*new MarkingGCAwareJITStubRoutine(code, vm, owner, cells));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitGCAwareJITStubRoutineh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -111,7 +111,7 @@
</span><span class="cx"> // appropriate. Generally you only need to pass pointers that will be used
</span><span class="cx"> // after the first call to C++ or JS.
</span><span class="cx"> // 
</span><del>-// PassRefPtr&lt;JITStubRoutine&gt; createJITStubRoutine(
</del><ins>+// Ref&lt;JITStubRoutine&gt; createJITStubRoutine(
</ins><span class="cx"> //    const MacroAssemblerCodeRef&amp; code,
</span><span class="cx"> //    VM&amp; vm,
</span><span class="cx"> //    const JSCell* owner,
</span><span class="lines">@@ -124,7 +124,7 @@
</span><span class="cx"> // this function using varargs, I ended up with more code than this simple
</span><span class="cx"> // way.
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;JITStubRoutine&gt; createJITStubRoutine(
</del><ins>+Ref&lt;JITStubRoutine&gt; createJITStubRoutine(
</ins><span class="cx">     const MacroAssemblerCodeRef&amp;, VM&amp;, const JSCell* owner, bool makesCalls,
</span><span class="cx">     const Vector&lt;JSCell*&gt;&amp; = { }, 
</span><span class="cx">     CodeBlock* codeBlockForExceptionHandlers = nullptr, CallSiteIndex exceptionHandlingCallSiteIndex = CallSiteIndex(std::numeric_limits&lt;unsigned&gt;::max()));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/jit/JIT.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -829,7 +829,7 @@
</span><span class="cx">     if (m_compilation) {
</span><span class="cx">         if (Options::disassembleBaselineForProfiler())
</span><span class="cx">             m_disassembler-&gt;reportToProfiler(m_compilation.get(), patchBuffer);
</span><del>-        m_vm-&gt;m_perBytecodeProfiler-&gt;addCompilation(m_codeBlock, m_compilation);
</del><ins>+        m_vm-&gt;m_perBytecodeProfiler-&gt;addCompilation(m_codeBlock, *m_compilation);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (m_pcToCodeOriginMapBuilder.didBuildMapping())
</span><span class="lines">@@ -845,7 +845,7 @@
</span><span class="cx"> 
</span><span class="cx">     m_codeBlock-&gt;shrinkToFit(CodeBlock::LateShrink);
</span><span class="cx">     m_codeBlock-&gt;setJITCode(
</span><del>-        adoptRef(new DirectJITCode(result, withArityCheck, JITCode::BaselineJIT)));
</del><ins>+        adoptRef(*new DirectJITCode(result, withArityCheck, JITCode::BaselineJIT)));
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE(JIT_VERBOSE)
</span><span class="cx">     dataLogF(&quot;JIT generated code for %p at [%p, %p).\n&quot;, m_codeBlock, result.executableMemory()-&gt;start(), result.executableMemory()-&gt;end());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITStubRoutineh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITStubRoutine.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITStubRoutine.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/jit/JITStubRoutine.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -70,11 +70,8 @@
</span><span class="cx">     // the churn.
</span><span class="cx">     const MacroAssemblerCodeRef&amp; code() const { return m_code; }
</span><span class="cx">     
</span><del>-    static MacroAssemblerCodePtr asCodePtr(PassRefPtr&lt;JITStubRoutine&gt; stubRoutine)
</del><ins>+    static MacroAssemblerCodePtr asCodePtr(Ref&lt;JITStubRoutine&gt;&amp;&amp; stubRoutine)
</ins><span class="cx">     {
</span><del>-        if (!stubRoutine)
-            return MacroAssemblerCodePtr();
-        
</del><span class="cx">         MacroAssemblerCodePtr result = stubRoutine-&gt;code().code();
</span><span class="cx">         ASSERT(!!result);
</span><span class="cx">         return result;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITThunkscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITThunks.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITThunks.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/jit/JITThunks.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -108,9 +108,9 @@
</span><span class="cx">     } else
</span><span class="cx">         forCall = adoptRef(new NativeJITCode(JIT::compileCTINativeCall(vm, function), JITCode::HostCallThunk));
</span><span class="cx">     
</span><del>-    RefPtr&lt;JITCode&gt; forConstruct = adoptRef(new NativeJITCode(MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct(vm)), JITCode::HostCallThunk));
</del><ins>+    Ref&lt;JITCode&gt; forConstruct = adoptRef(*new NativeJITCode(MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct(vm)), JITCode::HostCallThunk));
</ins><span class="cx">     
</span><del>-    NativeExecutable* nativeExecutable = NativeExecutable::create(*vm, forCall, function, forConstruct, constructor, intrinsic, signature, name);
</del><ins>+    NativeExecutable* nativeExecutable = NativeExecutable::create(*vm, forCall.releaseNonNull(), function, WTFMove(forConstruct), constructor, intrinsic, signature, name);
</ins><span class="cx">     weakAdd(*m_hostFunctionStubMap, std::make_tuple(function, constructor, name), Weak&lt;NativeExecutable&gt;(nativeExecutable, this));
</span><span class="cx">     return nativeExecutable;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntEntrypointcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntEntrypoint.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntEntrypoint.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/llint/LLIntEntrypoint.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -46,12 +46,12 @@
</span><span class="cx">     if (vm.canUseJIT()) {
</span><span class="cx">         if (kind == CodeForCall) {
</span><span class="cx">             codeBlock-&gt;setJITCode(
</span><del>-                adoptRef(new DirectJITCode(vm.getCTIStub(functionForCallEntryThunkGenerator), vm.getCTIStub(functionForCallArityCheckThunkGenerator).code(), JITCode::InterpreterThunk)));
</del><ins>+                adoptRef(*new DirectJITCode(vm.getCTIStub(functionForCallEntryThunkGenerator), vm.getCTIStub(functionForCallArityCheckThunkGenerator).code(), JITCode::InterpreterThunk)));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         ASSERT(kind == CodeForConstruct);
</span><span class="cx">         codeBlock-&gt;setJITCode(
</span><del>-            adoptRef(new DirectJITCode(vm.getCTIStub(functionForConstructEntryThunkGenerator), vm.getCTIStub(functionForConstructArityCheckThunkGenerator).code(), JITCode::InterpreterThunk)));
</del><ins>+            adoptRef(*new DirectJITCode(vm.getCTIStub(functionForConstructEntryThunkGenerator), vm.getCTIStub(functionForConstructArityCheckThunkGenerator).code(), JITCode::InterpreterThunk)));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> #endif // ENABLE(JIT)
</span><span class="lines">@@ -59,12 +59,12 @@
</span><span class="cx">     UNUSED_PARAM(vm);
</span><span class="cx">     if (kind == CodeForCall) {
</span><span class="cx">         codeBlock-&gt;setJITCode(
</span><del>-            adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_call_prologue), MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_call_arity_check), JITCode::InterpreterThunk)));
</del><ins>+            adoptRef(*new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_call_prologue), MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_call_arity_check), JITCode::InterpreterThunk)));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     ASSERT(kind == CodeForConstruct);
</span><span class="cx">     codeBlock-&gt;setJITCode(
</span><del>-        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_construct_prologue), MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_construct_arity_check), JITCode::InterpreterThunk)));
</del><ins>+        adoptRef(*new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_construct_prologue), MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_construct_arity_check), JITCode::InterpreterThunk)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static void setEvalEntrypoint(VM&amp; vm, CodeBlock* codeBlock)
</span><span class="lines">@@ -72,7 +72,7 @@
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx">     if (vm.canUseJIT()) {
</span><span class="cx">         codeBlock-&gt;setJITCode(
</span><del>-            adoptRef(new DirectJITCode(vm.getCTIStub(evalEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</del><ins>+            adoptRef(*new DirectJITCode(vm.getCTIStub(evalEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> #endif // ENABLE(JIT)
</span><span class="lines">@@ -79,7 +79,7 @@
</span><span class="cx"> 
</span><span class="cx">     UNUSED_PARAM(vm);
</span><span class="cx">     codeBlock-&gt;setJITCode(
</span><del>-        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_eval_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</del><ins>+        adoptRef(*new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_eval_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static void setProgramEntrypoint(VM&amp; vm, CodeBlock* codeBlock)
</span><span class="lines">@@ -87,7 +87,7 @@
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx">     if (vm.canUseJIT()) {
</span><span class="cx">         codeBlock-&gt;setJITCode(
</span><del>-            adoptRef(new DirectJITCode(vm.getCTIStub(programEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</del><ins>+            adoptRef(*new DirectJITCode(vm.getCTIStub(programEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> #endif // ENABLE(JIT)
</span><span class="lines">@@ -94,7 +94,7 @@
</span><span class="cx"> 
</span><span class="cx">     UNUSED_PARAM(vm);
</span><span class="cx">     codeBlock-&gt;setJITCode(
</span><del>-        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_program_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</del><ins>+        adoptRef(*new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_program_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static void setModuleProgramEntrypoint(VM&amp; vm, CodeBlock* codeBlock)
</span><span class="lines">@@ -102,7 +102,7 @@
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx">     if (vm.canUseJIT()) {
</span><span class="cx">         codeBlock-&gt;setJITCode(
</span><del>-            adoptRef(new DirectJITCode(vm.getCTIStub(moduleProgramEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</del><ins>+            adoptRef(*new DirectJITCode(vm.getCTIStub(moduleProgramEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> #endif // ENABLE(JIT)
</span><span class="lines">@@ -109,7 +109,7 @@
</span><span class="cx"> 
</span><span class="cx">     UNUSED_PARAM(vm);
</span><span class="cx">     codeBlock-&gt;setJITCode(
</span><del>-        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_module_program_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</del><ins>+        adoptRef(*new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_module_program_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void setEntrypoint(VM&amp; vm, CodeBlock* codeBlock)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserSourceCodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/SourceCode.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/SourceCode.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/parser/SourceCode.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -41,25 +41,32 @@
</span><span class="cx">         {
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        SourceCode(PassRefPtr&lt;SourceProvider&gt; provider)
-            : UnlinkedSourceCode(provider)
</del><ins>+        SourceCode(Ref&lt;SourceProvider&gt;&amp;&amp; provider)
+            : UnlinkedSourceCode(WTFMove(provider))
</ins><span class="cx">         {
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        SourceCode(PassRefPtr&lt;SourceProvider&gt; provider, int firstLine, int startColumn)
-            : UnlinkedSourceCode(provider)
</del><ins>+        SourceCode(Ref&lt;SourceProvider&gt;&amp;&amp; provider, int firstLine, int startColumn)
+            : UnlinkedSourceCode(WTFMove(provider))
</ins><span class="cx">             , m_firstLine(OrdinalNumber::fromOneBasedInt(std::max(firstLine, 1)))
</span><span class="cx">             , m_startColumn(OrdinalNumber::fromOneBasedInt(std::max(startColumn, 1)))
</span><span class="cx">         {
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        SourceCode(PassRefPtr&lt;SourceProvider&gt; provider, int startOffset, int endOffset, int firstLine, int startColumn)
-            : UnlinkedSourceCode(provider, startOffset, endOffset)
</del><ins>+        SourceCode(Ref&lt;SourceProvider&gt;&amp;&amp; provider, int startOffset, int endOffset, int firstLine, int startColumn)
+            : UnlinkedSourceCode(WTFMove(provider), startOffset, endOffset)
</ins><span class="cx">             , m_firstLine(OrdinalNumber::fromOneBasedInt(std::max(firstLine, 1)))
</span><span class="cx">             , m_startColumn(OrdinalNumber::fromOneBasedInt(std::max(startColumn, 1)))
</span><span class="cx">         {
</span><span class="cx">         }
</span><span class="cx"> 
</span><ins>+        SourceCode(RefPtr&lt;SourceProvider&gt;&amp;&amp; provider, int startOffset, int endOffset, int firstLine, int startColumn)
+            : UnlinkedSourceCode(WTFMove(provider), startOffset, endOffset)
+            , m_firstLine(OrdinalNumber::fromOneBasedInt(std::max(firstLine, 1)))
+            , m_startColumn(OrdinalNumber::fromOneBasedInt(std::max(startColumn, 1)))
+        {
+        }
+
</ins><span class="cx">         OrdinalNumber firstLine() const { return m_firstLine; }
</span><span class="cx">         OrdinalNumber startColumn() const { return m_startColumn; }
</span><span class="cx"> 
</span><span class="lines">@@ -87,7 +94,7 @@
</span><span class="cx">     inline SourceCode SourceCode::subExpression(unsigned openBrace, unsigned closeBrace, int firstLine, int startColumn)
</span><span class="cx">     {
</span><span class="cx">         startColumn += 1; // Convert to base 1.
</span><del>-        return SourceCode(provider(), openBrace, closeBrace + 1, firstLine, startColumn);
</del><ins>+        return SourceCode(RefPtr&lt;SourceProvider&gt; { provider() }, openBrace, closeBrace + 1, firstLine, startColumn);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserUnlinkedSourceCodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/UnlinkedSourceCode.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/UnlinkedSourceCode.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/parser/UnlinkedSourceCode.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -47,20 +47,27 @@
</span><span class="cx">         {
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        UnlinkedSourceCode(PassRefPtr&lt;SourceProvider&gt; provider)
-            : m_provider(provider)
</del><ins>+        UnlinkedSourceCode(Ref&lt;SourceProvider&gt;&amp;&amp; provider)
+            : m_provider(WTFMove(provider))
</ins><span class="cx">             , m_startOffset(0)
</span><span class="cx">             , m_endOffset(m_provider-&gt;source().length())
</span><span class="cx">         {
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        UnlinkedSourceCode(PassRefPtr&lt;SourceProvider&gt; provider, int startOffset, int endOffset)
-            : m_provider(provider)
</del><ins>+        UnlinkedSourceCode(Ref&lt;SourceProvider&gt;&amp;&amp; provider, int startOffset, int endOffset)
+            : m_provider(WTFMove(provider))
</ins><span class="cx">             , m_startOffset(startOffset)
</span><span class="cx">             , m_endOffset(endOffset)
</span><span class="cx">         {
</span><span class="cx">         }
</span><span class="cx"> 
</span><ins>+        UnlinkedSourceCode(RefPtr&lt;SourceProvider&gt;&amp;&amp; provider, int startOffset, int endOffset)
+            : m_provider(WTFMove(provider))
+            , m_startOffset(startOffset)
+            , m_endOffset(endOffset)
+        {
+        }
+
</ins><span class="cx">         UnlinkedSourceCode(const UnlinkedSourceCode&amp; other)
</span><span class="cx">             : m_provider(other.m_provider)
</span><span class="cx">             , m_startOffset(other.m_startOffset)
</span><span class="lines">@@ -91,6 +98,8 @@
</span><span class="cx">         int length() const { return m_endOffset - m_startOffset; }
</span><span class="cx"> 
</span><span class="cx">     protected:
</span><ins>+        // FIXME: Make it Ref&lt;SourceProvidier&gt;.
+        // https://bugs.webkit.org/show_bug.cgi?id=168325
</ins><span class="cx">         RefPtr&lt;SourceProvider&gt; m_provider;
</span><span class="cx">         int m_startOffset;
</span><span class="cx">         int m_endOffset;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreprofilerProfilerDatabasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -86,15 +86,13 @@
</span><span class="cx">     m_compilationMap.remove(codeBlock);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Database::addCompilation(CodeBlock* codeBlock, PassRefPtr&lt;Compilation&gt; passedCompilation)
</del><ins>+void Database::addCompilation(CodeBlock* codeBlock, Ref&lt;Compilation&gt;&amp;&amp; compilation)
</ins><span class="cx"> {
</span><span class="cx">     LockHolder locker(m_lock);
</span><span class="cx">     ASSERT(!isCompilationThread());
</span><span class="cx"> 
</span><del>-    RefPtr&lt;Compilation&gt; compilation = passedCompilation;
-    
-    m_compilations.append(compilation);
-    m_compilationMap.set(codeBlock, compilation);
</del><ins>+    m_compilations.append(compilation.copyRef());
+    m_compilationMap.set(codeBlock, WTFMove(compilation));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSValue Database::toJS(ExecState* exec) const
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreprofilerProfilerDatabaseh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/profiler/ProfilerDatabase.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/profiler/ProfilerDatabase.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/profiler/ProfilerDatabase.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -34,7 +34,6 @@
</span><span class="cx"> #include &lt;wtf/HashMap.h&gt;
</span><span class="cx"> #include &lt;wtf/Lock.h&gt;
</span><span class="cx"> #include &lt;wtf/Noncopyable.h&gt;
</span><del>-#include &lt;wtf/PassRefPtr.h&gt;
</del><span class="cx"> #include &lt;wtf/SegmentedVector.h&gt;
</span><span class="cx"> #include &lt;wtf/ThreadingPrimitives.h&gt;
</span><span class="cx"> #include &lt;wtf/text/WTFString.h&gt;
</span><span class="lines">@@ -52,7 +51,7 @@
</span><span class="cx">     Bytecodes* ensureBytecodesFor(CodeBlock*);
</span><span class="cx">     void notifyDestruction(CodeBlock*);
</span><span class="cx">     
</span><del>-    void addCompilation(CodeBlock*, PassRefPtr&lt;Compilation&gt;);
</del><ins>+    void addCompilation(CodeBlock*, Ref&lt;Compilation&gt;&amp;&amp;);
</ins><span class="cx">     
</span><span class="cx">     // Converts the database to a JavaScript object that is suitable for JSON stringification.
</span><span class="cx">     // Note that it's probably a good idea to use an ExecState* associated with a global
</span><span class="lines">@@ -85,8 +84,8 @@
</span><span class="cx">     VM&amp; m_vm;
</span><span class="cx">     SegmentedVector&lt;Bytecodes&gt; m_bytecodes;
</span><span class="cx">     HashMap&lt;CodeBlock*, Bytecodes*&gt; m_bytecodesMap;
</span><del>-    Vector&lt;RefPtr&lt;Compilation&gt;&gt; m_compilations;
-    HashMap&lt;CodeBlock*, RefPtr&lt;Compilation&gt;&gt; m_compilationMap;
</del><ins>+    Vector&lt;Ref&lt;Compilation&gt;&gt; m_compilations;
+    HashMap&lt;CodeBlock*, Ref&lt;Compilation&gt;&gt; m_compilationMap;
</ins><span class="cx">     Vector&lt;Event&gt; m_events;
</span><span class="cx">     bool m_shouldSaveAtExit;
</span><span class="cx">     CString m_atExitSaveFilename;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeEvalExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/EvalExecutable.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/EvalExecutable.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/EvalExecutable.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -43,7 +43,7 @@
</span><span class="cx">         return m_evalCodeBlock.get();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    PassRefPtr&lt;JITCode&gt; generatedJITCode()
</del><ins>+    Ref&lt;JITCode&gt; generatedJITCode()
</ins><span class="cx">     {
</span><span class="cx">         return generatedJITCodeForCall();
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeExecutableBaseh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ExecutableBase.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ExecutableBase.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/ExecutableBase.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -125,19 +125,19 @@
</span><span class="cx">     int m_numParametersForConstruct;
</span><span class="cx"> 
</span><span class="cx"> public:
</span><del>-    PassRefPtr&lt;JITCode&gt; generatedJITCodeForCall()
</del><ins>+    Ref&lt;JITCode&gt; generatedJITCodeForCall()
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(m_jitCodeForCall);
</span><del>-        return m_jitCodeForCall;
</del><ins>+        return *m_jitCodeForCall;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    PassRefPtr&lt;JITCode&gt; generatedJITCodeForConstruct()
</del><ins>+    Ref&lt;JITCode&gt; generatedJITCodeForConstruct()
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(m_jitCodeForConstruct);
</span><del>-        return m_jitCodeForConstruct;
</del><ins>+        return *m_jitCodeForConstruct;
</ins><span class="cx">     }
</span><span class="cx">         
</span><del>-    PassRefPtr&lt;JITCode&gt; generatedJITCodeFor(CodeSpecializationKind kind)
</del><ins>+    Ref&lt;JITCode&gt; generatedJITCodeFor(CodeSpecializationKind kind)
</ins><span class="cx">     {
</span><span class="cx">         if (kind == CodeForCall)
</span><span class="cx">             return generatedJITCodeForCall();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIdentifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Identifier.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Identifier.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/Identifier.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">     ASSERT(c);
</span><span class="cx">     ASSERT(c[0]);
</span><span class="cx">     if (!c[1])
</span><del>-        return *vm-&gt;smallStrings.singleCharacterStringRep(c[0]);
</del><ins>+        return vm-&gt;smallStrings.singleCharacterStringRep(c[0]);
</ins><span class="cx"> 
</span><span class="cx">     return *AtomicStringImpl::add(c);
</span><span class="cx"> }
</span><span class="lines">@@ -58,7 +58,7 @@
</span><span class="cx">         UChar c = s[0];
</span><span class="cx">         ASSERT(c &lt;= 0xff);
</span><span class="cx">         if (canUseSingleCharacterString(c))
</span><del>-            return *vm-&gt;smallStrings.singleCharacterStringRep(c);
</del><ins>+            return vm-&gt;smallStrings.singleCharacterStringRep(c);
</ins><span class="cx">     }
</span><span class="cx">     if (!length)
</span><span class="cx">         return *StringImpl::empty();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIdentifierh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Identifier.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Identifier.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/Identifier.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -218,7 +218,7 @@
</span><span class="cx">     if (length == 1) {
</span><span class="cx">         T c = s[0];
</span><span class="cx">         if (canUseSingleCharacterString(c))
</span><del>-            return *vm-&gt;smallStrings.singleCharacterStringRep(c);
</del><ins>+            return vm-&gt;smallStrings.singleCharacterStringRep(c);
</ins><span class="cx">     }
</span><span class="cx">     if (!length)
</span><span class="cx">         return *StringImpl::empty();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -1362,18 +1362,15 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(WEB_REPLAY)
</span><del>-void JSGlobalObject::setInputCursor(PassRefPtr&lt;InputCursor&gt; prpCursor)
</del><ins>+void JSGlobalObject::setInputCursor(Ref&lt;InputCursor&gt;&amp;&amp; cursor)
</ins><span class="cx"> {
</span><del>-    m_inputCursor = prpCursor;
-    ASSERT(m_inputCursor);
-
-    InputCursor&amp; cursor = inputCursor();
</del><ins>+    m_inputCursor = WTFMove(cursor);
</ins><span class="cx">     // Save or set the random seed. This performed here rather than the constructor
</span><span class="cx">     // to avoid threading the input cursor through all the abstraction layers.
</span><del>-    if (cursor.isCapturing())
-        cursor.appendInput&lt;SetRandomSeed&gt;(m_weakRandom.seed());
-    else if (cursor.isReplaying()) {
-        if (SetRandomSeed* input = cursor.fetchInput&lt;SetRandomSeed&gt;())
</del><ins>+    if (m_inputCursor-&gt;isCapturing())
+        m_inputCursor-&gt;appendInput&lt;SetRandomSeed&gt;(m_weakRandom.seed());
+    else if (m_inputCursor-&gt;isReplaying()) {
+        if (SetRandomSeed* input = m_inputCursor-&gt;fetchInput&lt;SetRandomSeed&gt;())
</ins><span class="cx">             m_weakRandom.setSeed(static_cast&lt;unsigned&gt;(input-&gt;randomSeed()));
</span><span class="cx">     }
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -44,7 +44,6 @@
</span><span class="cx"> #include &lt;JavaScriptCore/JSBase.h&gt;
</span><span class="cx"> #include &lt;array&gt;
</span><span class="cx"> #include &lt;wtf/HashSet.h&gt;
</span><del>-#include &lt;wtf/PassRefPtr.h&gt;
</del><span class="cx"> 
</span><span class="cx"> struct OpaqueJSClass;
</span><span class="cx"> struct OpaqueJSClassContextData;
</span><span class="lines">@@ -379,7 +378,7 @@
</span><span class="cx">     VM&amp; m_vm;
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(WEB_REPLAY)
</span><del>-    RefPtr&lt;InputCursor&gt; m_inputCursor;
</del><ins>+    Ref&lt;InputCursor&gt; m_inputCursor;
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(REMOTE_INSPECTOR)
</span><span class="lines">@@ -617,8 +616,8 @@
</span><span class="cx">     JS_EXPORT_PRIVATE bool remoteDebuggingEnabled() const;
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(WEB_REPLAY)
</span><del>-    JS_EXPORT_PRIVATE void setInputCursor(PassRefPtr&lt;InputCursor&gt;);
-    InputCursor&amp; inputCursor() const { return *m_inputCursor; }
</del><ins>+    JS_EXPORT_PRIVATE void setInputCursor(Ref&lt;InputCursor&gt;&amp;&amp;);
+    InputCursor&amp; inputCursor() const { return m_inputCursor.get(); }
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(REMOTE_INSPECTOR)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPropertyNameEnumeratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -38,18 +38,18 @@
</span><span class="cx"> {
</span><span class="cx">     if (!vm.emptyPropertyNameEnumerator.get()) {
</span><span class="cx">         PropertyNameArray propertyNames(&amp;vm, PropertyNameMode::Strings);
</span><del>-        vm.emptyPropertyNameEnumerator = Strong&lt;JSCell&gt;(vm, create(vm, 0, 0, 0, propertyNames));
</del><ins>+        vm.emptyPropertyNameEnumerator = Strong&lt;JSCell&gt;(vm, create(vm, 0, 0, 0, WTFMove(propertyNames)));
</ins><span class="cx">     }
</span><span class="cx">     return jsCast&lt;JSPropertyNameEnumerator*&gt;(vm.emptyPropertyNameEnumerator.get());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSPropertyNameEnumerator* JSPropertyNameEnumerator::create(VM&amp; vm, Structure* structure, uint32_t indexedLength, uint32_t numberStructureProperties, PropertyNameArray&amp; propertyNames)
</del><ins>+JSPropertyNameEnumerator* JSPropertyNameEnumerator::create(VM&amp; vm, Structure* structure, uint32_t indexedLength, uint32_t numberStructureProperties, PropertyNameArray&amp;&amp; propertyNames)
</ins><span class="cx"> {
</span><span class="cx">     StructureID structureID = structure ? structure-&gt;id() : 0;
</span><span class="cx">     uint32_t inlineCapacity = structure ? structure-&gt;inlineCapacity() : 0;
</span><span class="cx">     JSPropertyNameEnumerator* enumerator = new (NotNull, 
</span><span class="cx">         allocateCell&lt;JSPropertyNameEnumerator&gt;(vm.heap)) JSPropertyNameEnumerator(vm, structureID, inlineCapacity);
</span><del>-    enumerator-&gt;finishCreation(vm, indexedLength, numberStructureProperties, propertyNames.data());
</del><ins>+    enumerator-&gt;finishCreation(vm, indexedLength, numberStructureProperties, propertyNames.releaseData());
</ins><span class="cx">     return enumerator;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -60,11 +60,10 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JSPropertyNameEnumerator::finishCreation(VM&amp; vm, uint32_t indexedLength, uint32_t endStructurePropertyIndex, PassRefPtr&lt;PropertyNameArrayData&gt; idents)
</del><ins>+void JSPropertyNameEnumerator::finishCreation(VM&amp; vm, uint32_t indexedLength, uint32_t endStructurePropertyIndex, RefPtr&lt;PropertyNameArrayData&gt;&amp;&amp; identifiers)
</ins><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx"> 
</span><del>-    RefPtr&lt;PropertyNameArrayData&gt; identifiers = idents;
</del><span class="cx">     PropertyNameArrayData::PropertyNameVector&amp; vector = identifiers-&gt;propertyNameVector();
</span><span class="cx"> 
</span><span class="cx">     m_indexedLength = indexedLength;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPropertyNameEnumeratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
</span><span class="cx"> 
</span><span class="cx">     static JSPropertyNameEnumerator* create(VM&amp;);
</span><del>-    static JSPropertyNameEnumerator* create(VM&amp;, Structure*, uint32_t, uint32_t, PropertyNameArray&amp;);
</del><ins>+    static JSPropertyNameEnumerator* create(VM&amp;, Structure*, uint32_t, uint32_t, PropertyNameArray&amp;&amp;);
</ins><span class="cx"> 
</span><span class="cx">     static const bool needsDestruction = true;
</span><span class="cx">     static void destroy(JSCell*);
</span><span class="lines">@@ -85,7 +85,7 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     JSPropertyNameEnumerator(VM&amp;, StructureID, uint32_t);
</span><del>-    void finishCreation(VM&amp;, uint32_t, uint32_t, PassRefPtr&lt;PropertyNameArrayData&gt;);
</del><ins>+    void finishCreation(VM&amp;, uint32_t, uint32_t, RefPtr&lt;PropertyNameArrayData&gt;&amp;&amp;);
</ins><span class="cx"> 
</span><span class="cx">     Vector&lt;WriteBarrier&lt;JSString&gt;&gt; m_propertyNames;
</span><span class="cx">     StructureID m_cachedStructureID;
</span><span class="lines">@@ -135,7 +135,7 @@
</span><span class="cx"> 
</span><span class="cx">     normalizePrototypeChain(exec, structure);
</span><span class="cx"> 
</span><del>-    enumerator = JSPropertyNameEnumerator::create(vm, structure, indexedLength, numberStructureProperties, propertyNames);
</del><ins>+    enumerator = JSPropertyNameEnumerator::create(vm, structure, indexedLength, numberStructureProperties, WTFMove(propertyNames));
</ins><span class="cx">     enumerator-&gt;setCachedPrototypeChain(vm, structure-&gt;prototypeChain(exec));
</span><span class="cx">     if (!indexedLength &amp;&amp; structure-&gt;canCachePropertyNameEnumerator())
</span><span class="cx">         structure-&gt;setCachedPropertyNameEnumerator(vm, enumerator);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSStringh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSString.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSString.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/JSString.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -97,10 +97,10 @@
</span><span class="cx">     static const unsigned MaxLength = std::numeric_limits&lt;int32_t&gt;::max();
</span><span class="cx">     
</span><span class="cx"> private:
</span><del>-    JSString(VM&amp; vm, PassRefPtr&lt;StringImpl&gt; value)
</del><ins>+    JSString(VM&amp; vm, Ref&lt;StringImpl&gt;&amp;&amp; value)
</ins><span class="cx">         : JSCell(vm, vm.stringStructure.get())
</span><span class="cx">         , m_flags(0)
</span><del>-        , m_value(RefPtr&lt;StringImpl&gt;(value))
</del><ins>+        , m_value(WTFMove(value))
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -136,20 +136,18 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> public:
</span><del>-    static JSString* create(VM&amp; vm, PassRefPtr&lt;StringImpl&gt; value)
</del><ins>+    static JSString* create(VM&amp; vm, Ref&lt;StringImpl&gt;&amp;&amp; value)
</ins><span class="cx">     {
</span><del>-        ASSERT(value);
</del><span class="cx">         unsigned length = value-&gt;length();
</span><span class="cx">         size_t cost = value-&gt;cost();
</span><del>-        JSString* newString = new (NotNull, allocateCell&lt;JSString&gt;(vm.heap)) JSString(vm, value);
</del><ins>+        JSString* newString = new (NotNull, allocateCell&lt;JSString&gt;(vm.heap)) JSString(vm, WTFMove(value));
</ins><span class="cx">         newString-&gt;finishCreation(vm, length, cost);
</span><span class="cx">         return newString;
</span><span class="cx">     }
</span><del>-    static JSString* createHasOtherOwner(VM&amp; vm, PassRefPtr&lt;StringImpl&gt; value)
</del><ins>+    static JSString* createHasOtherOwner(VM&amp; vm, Ref&lt;StringImpl&gt;&amp;&amp; value)
</ins><span class="cx">     {
</span><del>-        ASSERT(value);
</del><span class="cx">         size_t length = value-&gt;length();
</span><del>-        JSString* newString = new (NotNull, allocateCell&lt;JSString&gt;(vm.heap)) JSString(vm, value);
</del><ins>+        JSString* newString = new (NotNull, allocateCell&lt;JSString&gt;(vm.heap)) JSString(vm, WTFMove(value));
</ins><span class="cx">         newString-&gt;finishCreation(vm, length);
</span><span class="cx">         return newString;
</span><span class="cx">     }
</span><span class="lines">@@ -506,19 +504,19 @@
</span><span class="cx"> {
</span><span class="cx">     if (c &lt;= maxSingleCharacterString)
</span><span class="cx">         return vm-&gt;smallStrings.singleCharacterString(c);
</span><del>-    return JSString::create(*vm, String(&amp;c, 1).impl());
</del><ins>+    return JSString::create(*vm, StringImpl::create(&amp;c, 1));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline JSString* jsNontrivialString(VM* vm, const String&amp; s)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(s.length() &gt; 1);
</span><del>-    return JSString::create(*vm, s.impl());
</del><ins>+    return JSString::create(*vm, *s.impl());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline JSString* jsNontrivialString(VM* vm, String&amp;&amp; s)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(s.length() &gt; 1);
</span><del>-    return JSString::create(*vm, s.releaseImpl());
</del><ins>+    return JSString::create(*vm, s.releaseImpl().releaseNonNull());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE Identifier JSString::toIdentifier(ExecState* exec) const
</span><span class="lines">@@ -572,7 +570,7 @@
</span><span class="cx">         if (c &lt;= maxSingleCharacterString)
</span><span class="cx">             return vm-&gt;smallStrings.singleCharacterString(c);
</span><span class="cx">     }
</span><del>-    return JSString::create(*vm, s.impl());
</del><ins>+    return JSString::create(*vm, *s.impl());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline JSString* jsSubstring(VM&amp; vm, ExecState* exec, JSString* s, unsigned offset, unsigned length)
</span><span class="lines">@@ -634,7 +632,7 @@
</span><span class="cx">         if (c &lt;= maxSingleCharacterString)
</span><span class="cx">             return vm-&gt;smallStrings.singleCharacterString(c);
</span><span class="cx">     }
</span><del>-    return JSString::createHasOtherOwner(*vm, s.impl());
</del><ins>+    return JSString::createHasOtherOwner(*vm, *s.impl());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline JSRopeString* jsStringBuilder(VM* vm)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeModuleProgramExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx">         return m_moduleProgramCodeBlock.get();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    PassRefPtr&lt;JITCode&gt; generatedJITCode()
</del><ins>+    Ref&lt;JITCode&gt; generatedJITCode()
</ins><span class="cx">     {
</span><span class="cx">         return generatedJITCodeForCall();
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNativeExecutablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NativeExecutable.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NativeExecutable.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/NativeExecutable.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -40,11 +40,11 @@
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo NativeExecutable::s_info = { &quot;NativeExecutable&quot;, &amp;ExecutableBase::s_info, 0, CREATE_METHOD_TABLE(NativeExecutable) };
</span><span class="cx"> 
</span><del>-NativeExecutable* NativeExecutable::create(VM&amp; vm, PassRefPtr&lt;JITCode&gt; callThunk, NativeFunction function, PassRefPtr&lt;JITCode&gt; constructThunk, NativeFunction constructor, Intrinsic intrinsic, const DOMJIT::Signature* signature, const String&amp; name)
</del><ins>+NativeExecutable* NativeExecutable::create(VM&amp; vm, Ref&lt;JITCode&gt;&amp;&amp; callThunk, NativeFunction function, Ref&lt;JITCode&gt;&amp;&amp; constructThunk, NativeFunction constructor, Intrinsic intrinsic, const DOMJIT::Signature* signature, const String&amp; name)
</ins><span class="cx"> {
</span><span class="cx">     NativeExecutable* executable;
</span><span class="cx">     executable = new (NotNull, allocateCell&lt;NativeExecutable&gt;(vm.heap)) NativeExecutable(vm, function, constructor, intrinsic, signature);
</span><del>-    executable-&gt;finishCreation(vm, callThunk, constructThunk, name);
</del><ins>+    executable-&gt;finishCreation(vm, WTFMove(callThunk), WTFMove(constructThunk), name);
</ins><span class="cx">     return executable;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -58,11 +58,11 @@
</span><span class="cx">     return Structure::create(vm, globalObject, proto, TypeInfo(CellType, StructureFlags), info());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void NativeExecutable::finishCreation(VM&amp; vm, PassRefPtr&lt;JITCode&gt; callThunk, PassRefPtr&lt;JITCode&gt; constructThunk, const String&amp; name)
</del><ins>+void NativeExecutable::finishCreation(VM&amp; vm, Ref&lt;JITCode&gt;&amp;&amp; callThunk, Ref&lt;JITCode&gt;&amp;&amp; constructThunk, const String&amp; name)
</ins><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><del>-    m_jitCodeForCall = callThunk;
-    m_jitCodeForConstruct = constructThunk;
</del><ins>+    m_jitCodeForCall = WTFMove(callThunk);
+    m_jitCodeForConstruct = WTFMove(constructThunk);
</ins><span class="cx">     m_jitCodeForCallWithArityCheck = m_jitCodeForCall-&gt;addressForCall(MustCheckArity);
</span><span class="cx">     m_jitCodeForConstructWithArityCheck = m_jitCodeForConstruct-&gt;addressForCall(MustCheckArity);
</span><span class="cx">     m_name = name;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNativeExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NativeExecutable.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NativeExecutable.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/NativeExecutable.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     typedef ExecutableBase Base;
</span><span class="cx">     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
</span><span class="cx"> 
</span><del>-    static NativeExecutable* create(VM&amp;, PassRefPtr&lt;JITCode&gt; callThunk, NativeFunction function, PassRefPtr&lt;JITCode&gt; constructThunk, NativeFunction constructor, Intrinsic, const DOMJIT::Signature*, const String&amp; name);
</del><ins>+    static NativeExecutable* create(VM&amp;, Ref&lt;JITCode&gt;&amp;&amp; callThunk, NativeFunction function, Ref&lt;JITCode&gt;&amp;&amp; constructThunk, NativeFunction constructor, Intrinsic, const DOMJIT::Signature*, const String&amp; name);
</ins><span class="cx"> 
</span><span class="cx">     static void destroy(JSCell*);
</span><span class="cx"> 
</span><span class="lines">@@ -79,7 +79,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> protected:
</span><del>-    void finishCreation(VM&amp;, PassRefPtr&lt;JITCode&gt; callThunk, PassRefPtr&lt;JITCode&gt; constructThunk, const String&amp; name);
</del><ins>+    void finishCreation(VM&amp;, Ref&lt;JITCode&gt;&amp;&amp; callThunk, Ref&lt;JITCode&gt;&amp;&amp; constructThunk, const String&amp; name);
</ins><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     friend class ExecutableBase;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeProgramExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ProgramExecutable.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ProgramExecutable.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/ProgramExecutable.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -53,7 +53,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSObject* checkSyntax(ExecState*);
</span><span class="cx"> 
</span><del>-    PassRefPtr&lt;JITCode&gt; generatedJITCode()
</del><ins>+    Ref&lt;JITCode&gt; generatedJITCode()
</ins><span class="cx">     {
</span><span class="cx">         return generatedJITCodeForCall();
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePropertyNameArrayh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PropertyNameArray.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PropertyNameArray.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/PropertyNameArray.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -73,9 +73,8 @@
</span><span class="cx">     Identifier&amp; operator[](unsigned i) { return m_data-&gt;propertyNameVector()[i]; }
</span><span class="cx">     const Identifier&amp; operator[](unsigned i) const { return m_data-&gt;propertyNameVector()[i]; }
</span><span class="cx"> 
</span><del>-    void setData(PassRefPtr&lt;PropertyNameArrayData&gt; data) { m_data = data; }
</del><span class="cx">     PropertyNameArrayData* data() { return m_data.get(); }
</span><del>-    PassRefPtr&lt;PropertyNameArrayData&gt; releaseData() { return WTFMove(m_data); }
</del><ins>+    RefPtr&lt;PropertyNameArrayData&gt; releaseData() { return WTFMove(m_data); }
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: Remove these functions.
</span><span class="cx">     bool canAddKnownUniqueForStructure() const { return m_data-&gt;propertyNameVector().isEmpty(); }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExpKeyh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpKey.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpKey.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/RegExpKey.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -63,9 +63,9 @@
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    RegExpKey(RegExpFlags flags, const PassRefPtr&lt;StringImpl&gt; pattern)
</del><ins>+    RegExpKey(RegExpFlags flags, RefPtr&lt;StringImpl&gt;&amp;&amp; pattern)
</ins><span class="cx">         : flagsValue(flags)
</span><del>-        , pattern(pattern)
</del><ins>+        , pattern(WTFMove(pattern))
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSmallStringscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SmallStrings.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SmallStrings.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/SmallStrings.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -39,9 +39,9 @@
</span><span class="cx"> public:
</span><span class="cx">     SmallStringsStorage();
</span><span class="cx"> 
</span><del>-    StringImpl* rep(unsigned char character)
</del><ins>+    StringImpl&amp; rep(unsigned char character)
</ins><span class="cx">     {
</span><del>-        return m_reps[character].get();
</del><ins>+        return *m_reps[character].get();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="lines">@@ -110,7 +110,7 @@
</span><span class="cx"> void SmallStrings::createEmptyString(VM* vm)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!m_emptyString);
</span><del>-    m_emptyString = JSString::createHasOtherOwner(*vm, StringImpl::empty());
</del><ins>+    m_emptyString = JSString::createHasOtherOwner(*vm, *StringImpl::empty());
</ins><span class="cx">     ASSERT(m_needsToBeVisited);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -119,11 +119,11 @@
</span><span class="cx">     if (!m_storage)
</span><span class="cx">         m_storage = std::make_unique&lt;SmallStringsStorage&gt;();
</span><span class="cx">     ASSERT(!m_singleCharacterStrings[character]);
</span><del>-    m_singleCharacterStrings[character] = JSString::createHasOtherOwner(*vm, PassRefPtr&lt;StringImpl&gt;(m_storage-&gt;rep(character)));
</del><ins>+    m_singleCharacterStrings[character] = JSString::createHasOtherOwner(*vm, m_storage-&gt;rep(character));
</ins><span class="cx">     ASSERT(m_needsToBeVisited);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-StringImpl* SmallStrings::singleCharacterStringRep(unsigned char character)
</del><ins>+StringImpl&amp; SmallStrings::singleCharacterStringRep(unsigned char character)
</ins><span class="cx"> {
</span><span class="cx">     if (!m_storage)
</span><span class="cx">         m_storage = std::make_unique&lt;SmallStringsStorage&gt;();
</span><span class="lines">@@ -132,7 +132,7 @@
</span><span class="cx"> 
</span><span class="cx"> void SmallStrings::initialize(VM* vm, JSString*&amp; string, const char* value)
</span><span class="cx"> {
</span><del>-    string = JSString::create(*vm, Identifier::fromString(vm, value).impl());
</del><ins>+    string = JSString::create(*vm, AtomicStringImpl::add(value).releaseNonNull());
</ins><span class="cx">     ASSERT(m_needsToBeVisited);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSmallStringsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SmallStrings.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SmallStrings.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/SmallStrings.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -71,7 +71,7 @@
</span><span class="cx">         return m_singleCharacterStrings[character];
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    JS_EXPORT_PRIVATE WTF::StringImpl* singleCharacterStringRep(unsigned char character);
</del><ins>+    JS_EXPORT_PRIVATE WTF::StringImpl&amp; singleCharacterStringRep(unsigned char character);
</ins><span class="cx"> 
</span><span class="cx">     JSString** singleCharacterStrings() { return &amp;m_singleCharacterStrings[0]; }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructurecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/Structure.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -1143,10 +1143,10 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;StructureShape&gt; Structure::toStructureShape(JSValue value)
</del><ins>+Ref&lt;StructureShape&gt; Structure::toStructureShape(JSValue value)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;StructureShape&gt; baseShape = StructureShape::create();
-    RefPtr&lt;StructureShape&gt; curShape = baseShape;
</del><ins>+    Ref&lt;StructureShape&gt; baseShape = StructureShape::create();
+    RefPtr&lt;StructureShape&gt; curShape = baseShape.ptr();
</ins><span class="cx">     Structure* curStructure = this;
</span><span class="cx">     JSValue curValue = value;
</span><span class="cx">     while (curStructure) {
</span><span class="lines">@@ -1168,7 +1168,7 @@
</span><span class="cx"> 
</span><span class="cx">         if (curStructure-&gt;storedPrototypeStructure()) {
</span><span class="cx">             auto newShape = StructureShape::create();
</span><del>-            curShape-&gt;setProto(newShape.ptr());
</del><ins>+            curShape-&gt;setProto(newShape.copyRef());
</ins><span class="cx">             curShape = WTFMove(newShape);
</span><span class="cx">             curValue = curStructure-&gt;storedPrototype();
</span><span class="cx">         }
</span><span class="lines">@@ -1176,7 +1176,7 @@
</span><span class="cx">         curStructure = curStructure-&gt;storedPrototypeStructure();
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    return WTFMove(baseShape);
</del><ins>+    return baseShape;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool Structure::canUseForAllocationsOf(Structure* other)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/Structure.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -46,7 +46,6 @@
</span><span class="cx"> #include &quot;Weak.h&quot;
</span><span class="cx"> #include &quot;WriteBarrierInlines.h&quot;
</span><span class="cx"> #include &lt;wtf/CompilationThread.h&gt;
</span><del>-#include &lt;wtf/PassRefPtr.h&gt;
</del><span class="cx"> #include &lt;wtf/PrintStream.h&gt;
</span><span class="cx"> 
</span><span class="cx"> namespace WTF {
</span><span class="lines">@@ -592,7 +591,7 @@
</span><span class="cx">         willStoreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::OldProperty);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    PassRefPtr&lt;StructureShape&gt; toStructureShape(JSValue);
</del><ins>+    Ref&lt;StructureShape&gt; toStructureShape(JSValue);
</ins><span class="cx">     
</span><span class="cx">     // Determines if the two structures match enough that this one could be used for allocations
</span><span class="cx">     // of the other one.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypeLocationCachecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TypeLocationCache.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypeLocationCache.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/TypeLocationCache.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -32,7 +32,7 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><del>-std::pair&lt;TypeLocation*, bool&gt; TypeLocationCache::getTypeLocation(GlobalVariableID globalVariableID, intptr_t sourceID, unsigned start, unsigned end, PassRefPtr&lt;TypeSet&gt; globalTypeSet, VM* vm)
</del><ins>+std::pair&lt;TypeLocation*, bool&gt; TypeLocationCache::getTypeLocation(GlobalVariableID globalVariableID, intptr_t sourceID, unsigned start, unsigned end, RefPtr&lt;TypeSet&gt;&amp;&amp; globalTypeSet, VM* vm)
</ins><span class="cx"> {
</span><span class="cx">     LocationKey key;
</span><span class="cx">     key.m_globalVariableID = globalVariableID;
</span><span class="lines">@@ -48,7 +48,7 @@
</span><span class="cx">         location-&gt;m_sourceID = sourceID;
</span><span class="cx">         location-&gt;m_divotStart = start;
</span><span class="cx">         location-&gt;m_divotEnd = end;
</span><del>-        location-&gt;m_globalTypeSet = globalTypeSet;
</del><ins>+        location-&gt;m_globalTypeSet = WTFMove(globalTypeSet);
</ins><span class="cx"> 
</span><span class="cx">         m_locationMap[key] = location;
</span><span class="cx">         isNewLocation = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypeLocationCacheh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TypeLocationCache.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypeLocationCache.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/TypeLocationCache.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -56,7 +56,7 @@
</span><span class="cx">         unsigned m_end;
</span><span class="cx">     };
</span><span class="cx"> 
</span><del>-    std::pair&lt;TypeLocation*, bool&gt; getTypeLocation(GlobalVariableID, intptr_t, unsigned start, unsigned end, PassRefPtr&lt;TypeSet&gt;, VM*);
</del><ins>+    std::pair&lt;TypeLocation*, bool&gt; getTypeLocation(GlobalVariableID, intptr_t, unsigned start, unsigned end, RefPtr&lt;TypeSet&gt;&amp;&amp;, VM*);
</ins><span class="cx"> private:     
</span><span class="cx">     typedef std::unordered_map&lt;LocationKey, TypeLocation*, HashMethod&lt;LocationKey&gt;&gt; LocationMap;
</span><span class="cx">     LocationMap m_locationMap;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypeProfilerLogcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TypeProfilerLog.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypeProfilerLog.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/TypeProfilerLog.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -82,8 +82,8 @@
</span><span class="cx">         TypeLocation* location = entry-&gt;location;
</span><span class="cx">         location-&gt;m_lastSeenType = type;
</span><span class="cx">         if (location-&gt;m_globalTypeSet)
</span><del>-            location-&gt;m_globalTypeSet-&gt;addTypeInformation(type, shape, structure);
-        location-&gt;m_instructionTypeSet-&gt;addTypeInformation(type, shape, structure);
</del><ins>+            location-&gt;m_globalTypeSet-&gt;addTypeInformation(type, shape.copyRef(), structure);
+        location-&gt;m_instructionTypeSet-&gt;addTypeInformation(type, WTFMove(shape), structure);
</ins><span class="cx"> 
</span><span class="cx">         entry++;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypeSetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TypeSet.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypeSet.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/TypeSet.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -41,12 +41,12 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void TypeSet::addTypeInformation(RuntimeType type, PassRefPtr&lt;StructureShape&gt; prpNewShape, Structure* structure) 
</del><ins>+void TypeSet::addTypeInformation(RuntimeType type, RefPtr&lt;StructureShape&gt;&amp;&amp; passedNewShape, Structure* structure)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;StructureShape&gt; newShape = prpNewShape;
</del><span class="cx">     m_seenTypes = m_seenTypes | type;
</span><span class="cx"> 
</span><del>-    if (structure &amp;&amp; newShape &amp;&amp; !runtimeTypeIsPrimitive(type)) {
</del><ins>+    if (structure &amp;&amp; passedNewShape &amp;&amp; !runtimeTypeIsPrimitive(type)) {
+        Ref&lt;StructureShape&gt; newShape = passedNewShape.releaseNonNull();
</ins><span class="cx">         if (!m_structureSet.contains(structure)) {
</span><span class="cx">             {
</span><span class="cx">                 ConcurrentJSLocker locker(m_lock);
</span><span class="lines">@@ -56,26 +56,22 @@
</span><span class="cx">             // - We don't have two instances of the same shape. (Same shapes may have different Structures).
</span><span class="cx">             // - We don't have two shapes that share the same prototype chain. If these shapes share the same 
</span><span class="cx">             //   prototype chain, they will be merged into one shape.
</span><del>-            bool found = false;
</del><span class="cx">             String hash = newShape-&gt;propertyHash();
</span><span class="cx">             for (auto&amp; seenShape : m_structureHistory) {
</span><del>-                if (seenShape-&gt;propertyHash() == hash) {
-                    found = true;
-                    break;
-                } 
-                if (seenShape-&gt;hasSamePrototypeChain(newShape)) {
-                    seenShape = StructureShape::merge(seenShape, newShape);
-                    found = true;
-                    break;
</del><ins>+                if (seenShape-&gt;propertyHash() == hash)
+                    return;
+                if (seenShape-&gt;hasSamePrototypeChain(newShape.get())) {
+                    seenShape = StructureShape::merge(seenShape.copyRef(), WTFMove(newShape));
+                    return;
</ins><span class="cx">                 }
</span><span class="cx">             }
</span><span class="cx"> 
</span><del>-            if (!found) {
-                if (m_structureHistory.size() &lt; 100)
-                    m_structureHistory.append(newShape);
-                else if (!m_isOverflown)
-                    m_isOverflown = true;
</del><ins>+            if (m_structureHistory.size() &lt; 100) {
+                m_structureHistory.append(WTFMove(newShape));
+                return;
</ins><span class="cx">             }
</span><ins>+            if (!m_isOverflown)
+                m_isOverflown = true;
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -222,8 +218,8 @@
</span><span class="cx"> {
</span><span class="cx">     auto description = Inspector::Protocol::Array&lt;Inspector::Protocol::Runtime::StructureDescription&gt;::create();
</span><span class="cx"> 
</span><del>-    for (size_t i = 0; i &lt; m_structureHistory.size(); i++)
-        description-&gt;addItem(m_structureHistory.at(i)-&gt;inspectorRepresentation());
</del><ins>+    for (auto&amp; shape : m_structureHistory)
+        description-&gt;addItem(shape-&gt;inspectorRepresentation());
</ins><span class="cx"> 
</span><span class="cx">     return description;
</span><span class="cx"> }
</span><span class="lines">@@ -367,16 +363,16 @@
</span><span class="cx">     return *m_propertyHash;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-String StructureShape::leastCommonAncestor(const Vector&lt;RefPtr&lt;StructureShape&gt;&gt; shapes)
</del><ins>+String StructureShape::leastCommonAncestor(const Vector&lt;Ref&lt;StructureShape&gt;&gt;&amp; shapes)
</ins><span class="cx"> {
</span><del>-    if (!shapes.size())
</del><ins>+    if (shapes.isEmpty())
</ins><span class="cx">         return emptyString();
</span><span class="cx"> 
</span><del>-    RefPtr&lt;StructureShape&gt; origin = shapes.at(0);
</del><ins>+    StructureShape* origin = shapes[0].ptr();
</ins><span class="cx">     for (size_t i = 1; i &lt; shapes.size(); i++) {
</span><span class="cx">         bool foundLUB = false;
</span><span class="cx">         while (!foundLUB) {
</span><del>-            RefPtr&lt;StructureShape&gt; check = shapes.at(i);
</del><ins>+            StructureShape* check = shapes[i].ptr();
</ins><span class="cx">             String curCtorName = origin-&gt;m_constructorName;
</span><span class="cx">             while (check) {
</span><span class="cx">                 if (check-&gt;m_constructorName == curCtorName) {
</span><span class="lines">@@ -383,14 +379,14 @@
</span><span class="cx">                     foundLUB = true;
</span><span class="cx">                     break;
</span><span class="cx">                 }
</span><del>-                check = check-&gt;m_proto;
</del><ins>+                check = check-&gt;m_proto.get();
</ins><span class="cx">             }
</span><span class="cx">             if (!foundLUB) {
</span><del>-                origin = origin-&gt;m_proto;
</del><span class="cx">                 // This is unlikely to happen, because we usually bottom out at &quot;Object&quot;, but there are some sets of Objects
</span><span class="cx">                 // that may cause this behavior. We fall back to &quot;Object&quot; because it's our version of Top.
</span><del>-                if (!origin)
</del><ins>+                if (!origin-&gt;m_proto)
</ins><span class="cx">                     return ASCIILiteral(&quot;Object&quot;);
</span><ins>+                origin = origin-&gt;m_proto.get();
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -529,25 +525,23 @@
</span><span class="cx">     return base;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool StructureShape::hasSamePrototypeChain(PassRefPtr&lt;StructureShape&gt; prpOther)
</del><ins>+bool StructureShape::hasSamePrototypeChain(const StructureShape&amp; otherRef)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;StructureShape&gt; self = this;
-    RefPtr&lt;StructureShape&gt; other = prpOther;
</del><ins>+    const StructureShape* self = this;
+    const StructureShape* other = &amp;otherRef;
</ins><span class="cx">     while (self &amp;&amp; other) {
</span><span class="cx">         if (self-&gt;m_constructorName != other-&gt;m_constructorName)
</span><span class="cx">             return false;
</span><del>-        self = self-&gt;m_proto;
-        other = other-&gt;m_proto;
</del><ins>+        self = self-&gt;m_proto.get();
+        other = other-&gt;m_proto.get();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return !self &amp;&amp; !other;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;StructureShape&gt; StructureShape::merge(const PassRefPtr&lt;StructureShape&gt; prpA, const PassRefPtr&lt;StructureShape&gt; prpB)
</del><ins>+Ref&lt;StructureShape&gt; StructureShape::merge(Ref&lt;StructureShape&gt;&amp;&amp; a, Ref&lt;StructureShape&gt;&amp;&amp; b)
</ins><span class="cx"> {
</span><del>-    RefPtr&lt;StructureShape&gt; a = prpA;
-    RefPtr&lt;StructureShape&gt; b = prpB;
-    ASSERT(a-&gt;hasSamePrototypeChain(b));
</del><ins>+    ASSERT(a-&gt;hasSamePrototypeChain(b.get()));
</ins><span class="cx"> 
</span><span class="cx">     auto merged = StructureShape::create();
</span><span class="cx">     for (auto field : a-&gt;m_fields) {
</span><span class="lines">@@ -574,12 +568,12 @@
</span><span class="cx"> 
</span><span class="cx">     if (a-&gt;m_proto) {
</span><span class="cx">         RELEASE_ASSERT(b-&gt;m_proto);
</span><del>-        merged-&gt;setProto(StructureShape::merge(a-&gt;m_proto, b-&gt;m_proto));
</del><ins>+        merged-&gt;setProto(StructureShape::merge(*a-&gt;m_proto, *b-&gt;m_proto));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     merged-&gt;markAsFinal();
</span><span class="cx"> 
</span><del>-    return WTFMove(merged);
</del><ins>+    return merged;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void StructureShape::enterDictionaryMode()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypeSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TypeSet.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypeSet.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/TypeSet.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -63,13 +63,13 @@
</span><span class="cx">     Ref&lt;Inspector::Protocol::Runtime::StructureDescription&gt; inspectorRepresentation();
</span><span class="cx">     void setConstructorName(String name) { m_constructorName = (name.isEmpty() ? ASCIILiteral(&quot;Object&quot;) : name); }
</span><span class="cx">     String constructorName() { return m_constructorName; }
</span><del>-    void setProto(PassRefPtr&lt;StructureShape&gt; shape) { m_proto = shape; }
</del><ins>+    void setProto(Ref&lt;StructureShape&gt;&amp;&amp; shape) { m_proto = WTFMove(shape); }
</ins><span class="cx">     void enterDictionaryMode();
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    static String leastCommonAncestor(const Vector&lt;RefPtr&lt;StructureShape&gt;&gt;);
-    static PassRefPtr&lt;StructureShape&gt; merge(const PassRefPtr&lt;StructureShape&gt;, const PassRefPtr&lt;StructureShape&gt;);
-    bool hasSamePrototypeChain(PassRefPtr&lt;StructureShape&gt;);
</del><ins>+    static String leastCommonAncestor(const Vector&lt;Ref&lt;StructureShape&gt;&gt;&amp;);
+    static Ref&lt;StructureShape&gt; merge(Ref&lt;StructureShape&gt;&amp;&amp;, Ref&lt;StructureShape&gt;&amp;&amp;);
+    bool hasSamePrototypeChain(const StructureShape&amp;);
</ins><span class="cx"> 
</span><span class="cx">     HashSet&lt;RefPtr&lt;UniquedStringImpl&gt;, IdentifierRepHash&gt; m_fields;
</span><span class="cx">     HashSet&lt;RefPtr&lt;UniquedStringImpl&gt;, IdentifierRepHash&gt; m_optionalFields;
</span><span class="lines">@@ -85,7 +85,7 @@
</span><span class="cx"> public:
</span><span class="cx">     static Ref&lt;TypeSet&gt; create() { return adoptRef(*new TypeSet); }
</span><span class="cx">     TypeSet();
</span><del>-    void addTypeInformation(RuntimeType, PassRefPtr&lt;StructureShape&gt;, Structure*);
</del><ins>+    void addTypeInformation(RuntimeType, RefPtr&lt;StructureShape&gt;&amp;&amp;, Structure*);
</ins><span class="cx">     void invalidateCache();
</span><span class="cx">     String dumpTypes() const;
</span><span class="cx">     String displayName() const;
</span><span class="lines">@@ -103,7 +103,7 @@
</span><span class="cx"> private:
</span><span class="cx">     bool m_isOverflown;
</span><span class="cx">     RuntimeTypeMask m_seenTypes;
</span><del>-    Vector&lt;RefPtr&lt;StructureShape&gt;&gt; m_structureHistory;
</del><ins>+    Vector&lt;Ref&lt;StructureShape&gt;&gt; m_structureHistory;
</ins><span class="cx">     StructureSet m_structureSet;
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -549,8 +549,8 @@
</span><span class="cx">     UNUSED_PARAM(intrinsic);
</span><span class="cx"> #endif // ENABLE(JIT)
</span><span class="cx">     return NativeExecutable::create(*this,
</span><del>-        adoptRef(new NativeJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_native_call_trampoline), JITCode::HostCallThunk)), function,
-        adoptRef(new NativeJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_native_construct_trampoline), JITCode::HostCallThunk)), constructor,
</del><ins>+        adoptRef(*new NativeJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_native_call_trampoline), JITCode::HostCallThunk)), function,
+        adoptRef(*new NativeJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_native_construct_trampoline), JITCode::HostCallThunk)), constructor,
</ins><span class="cx">         NoIntrinsic, signature, name);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -868,9 +868,9 @@
</span><span class="cx">     typeProfiler()-&gt;dumpTypeProfilerData(*this);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void VM::queueMicrotask(JSGlobalObject* globalObject, PassRefPtr&lt;Microtask&gt; task)
</del><ins>+void VM::queueMicrotask(JSGlobalObject* globalObject, Ref&lt;Microtask&gt;&amp;&amp; task)
</ins><span class="cx"> {
</span><del>-    m_microtaskQueue.append(std::make_unique&lt;QueuedTask&gt;(*this, globalObject, task));
</del><ins>+    m_microtaskQueue.append(std::make_unique&lt;QueuedTask&gt;(*this, globalObject, WTFMove(task)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void VM::drainMicrotasks()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/runtime/VM.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -192,15 +192,15 @@
</span><span class="cx"> public:
</span><span class="cx">     void run();
</span><span class="cx"> 
</span><del>-    QueuedTask(VM&amp; vm, JSGlobalObject* globalObject, PassRefPtr&lt;Microtask&gt; microtask)
</del><ins>+    QueuedTask(VM&amp; vm, JSGlobalObject* globalObject, Ref&lt;Microtask&gt;&amp;&amp; microtask)
</ins><span class="cx">         : m_globalObject(vm, globalObject)
</span><del>-        , m_microtask(microtask)
</del><ins>+        , m_microtask(WTFMove(microtask))
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     Strong&lt;JSGlobalObject&gt; m_globalObject;
</span><del>-    RefPtr&lt;Microtask&gt; m_microtask;
</del><ins>+    Ref&lt;Microtask&gt; m_microtask;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> class ConservativeRoots;
</span><span class="lines">@@ -659,7 +659,7 @@
</span><span class="cx">     bool enableControlFlowProfiler();
</span><span class="cx">     bool disableControlFlowProfiler();
</span><span class="cx"> 
</span><del>-    JS_EXPORT_PRIVATE void queueMicrotask(JSGlobalObject*, PassRefPtr&lt;Microtask&gt;);
</del><ins>+    JS_EXPORT_PRIVATE void queueMicrotask(JSGlobalObject*, Ref&lt;Microtask&gt;&amp;&amp;);
</ins><span class="cx">     JS_EXPORT_PRIVATE void drainMicrotasks();
</span><span class="cx">     void setGlobalConstRedeclarationShouldThrow(bool globalConstRedeclarationThrow) { m_globalConstRedeclarationShouldThrow = globalConstRedeclarationThrow; }
</span><span class="cx">     ALWAYS_INLINE bool globalConstRedeclarationShouldThrow() const { return m_globalConstRedeclarationShouldThrow; }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretoolsFunctionOverridescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tools/FunctionOverrides.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tools/FunctionOverrides.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/JavaScriptCore/tools/FunctionOverrides.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -125,7 +125,7 @@
</span><span class="cx">     newProviderStr.append(origHeader);
</span><span class="cx">     newProviderStr.append(newBody);
</span><span class="cx"> 
</span><del>-    auto newProvider = StringSourceProvider::create(newProviderStr, SourceOrigin { &quot;&lt;overridden&gt;&quot; }, &quot;&lt;overridden&gt;&quot;);
</del><ins>+    Ref&lt;SourceProvider&gt; newProvider = StringSourceProvider::create(newProviderStr, SourceOrigin { &quot;&lt;overridden&gt;&quot; }, &quot;&lt;overridden&gt;&quot;);
</ins><span class="cx"> 
</span><span class="cx">     info.firstLine = 1;
</span><span class="cx">     info.lineCount = 1; // Faking it. This doesn't really matter for now.
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/WebCore/ChangeLog        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -1,3 +1,18 @@
</span><ins>+2017-02-15  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
+
+        [JSC] Drop PassRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=168320
+
+        Reviewed by Saam Barati.
+
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        Use Ref and pass it to SourceCode.
+
+        * replay/ReplayController.cpp:
+        (WebCore::ReplayController::frameNavigated):
+        Pass reference.
+
</ins><span class="cx"> 2017-02-15  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [GStreamer][MSE][EME] Handle protection event also at decryptor level
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsScriptSourceCodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/ScriptSourceCode.h (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/ScriptSourceCode.h        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/WebCore/bindings/js/ScriptSourceCode.h        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -45,7 +45,7 @@
</span><span class="cx"> public:
</span><span class="cx">     ScriptSourceCode(const String&amp; source, const URL&amp; url = URL(), const TextPosition&amp; startPosition = TextPosition(), JSC::SourceProviderSourceType sourceType = JSC::SourceProviderSourceType::Program)
</span><span class="cx">         : m_provider(JSC::StringSourceProvider::create(source, JSC::SourceOrigin { url.string() }, url.string(), startPosition, sourceType))
</span><del>-        , m_code(m_provider, startPosition.m_line.oneBasedInt(), startPosition.m_column.oneBasedInt())
</del><ins>+        , m_code(m_provider.copyRef(), startPosition.m_line.oneBasedInt(), startPosition.m_column.oneBasedInt())
</ins><span class="cx">         , m_url(url)
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="lines">@@ -52,7 +52,7 @@
</span><span class="cx"> 
</span><span class="cx">     ScriptSourceCode(CachedScript* cachedScript, JSC::SourceProviderSourceType sourceType, Ref&lt;CachedScriptFetcher&gt;&amp;&amp; scriptFetcher)
</span><span class="cx">         : m_provider(CachedScriptSourceProvider::create(cachedScript, sourceType, WTFMove(scriptFetcher)))
</span><del>-        , m_code(m_provider)
</del><ins>+        , m_code(m_provider.copyRef())
</ins><span class="cx">         , m_cachedScript(cachedScript)
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="lines">@@ -59,7 +59,7 @@
</span><span class="cx"> 
</span><span class="cx">     ScriptSourceCode(const String&amp; source, const URL&amp; url, const TextPosition&amp; startPosition, JSC::SourceProviderSourceType sourceType, Ref&lt;CachedScriptFetcher&gt;&amp;&amp; scriptFetcher)
</span><span class="cx">         : m_provider(JSC::StringSourceProvider::create(source, JSC::SourceOrigin { url.string(), WTFMove(scriptFetcher) }, url.string(), startPosition, sourceType))
</span><del>-        , m_code(m_provider, startPosition.m_line.oneBasedInt(), startPosition.m_column.oneBasedInt())
</del><ins>+        , m_code(m_provider.copyRef(), startPosition.m_line.oneBasedInt(), startPosition.m_column.oneBasedInt())
</ins><span class="cx">         , m_url(url)
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="lines">@@ -77,7 +77,7 @@
</span><span class="cx">     const URL&amp; url() const { return m_url; }
</span><span class="cx">     
</span><span class="cx"> private:
</span><del>-    RefPtr&lt;JSC::SourceProvider&gt; m_provider;
</del><ins>+    Ref&lt;JSC::SourceProvider&gt; m_provider;
</ins><span class="cx">     JSC::SourceCode m_code;
</span><span class="cx">     CachedResourceHandle&lt;CachedScript&gt; m_cachedScript;
</span><span class="cx">     URL m_url;
</span></span></pre></div>
<a id="trunkSourceWebCorereplayReplayControllercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/replay/ReplayController.cpp (212364 => 212365)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/replay/ReplayController.cpp        2017-02-15 16:35:39 UTC (rev 212364)
+++ trunk/Source/WebCore/replay/ReplayController.cpp        2017-02-15 17:09:22 UTC (rev 212365)
</span><span class="lines">@@ -421,7 +421,7 @@
</span><span class="cx">     // We store the input cursor in both Document and JSDOMWindow, so that
</span><span class="cx">     // replay state is accessible from JavaScriptCore and script-free layout code.
</span><span class="cx">     frame.document()-&gt;setInputCursor(*m_activeCursor);
</span><del>-    frame.script().globalObject(mainThreadNormalWorld())-&gt;setInputCursor(m_activeCursor.get());
</del><ins>+    frame.script().globalObject(mainThreadNormalWorld())-&gt;setInputCursor(*m_activeCursor);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ReplayController::frameDetached(Frame&amp; frame)
</span></span></pre>
</div>
</div>

</body>
</html>